foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-04-22 06:19:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

profiles/system: add hardened config

Browse Source
This commit is contained in:
Gabriel Arazas 2022-11-23 22:45:06 +08:00
parent 6a9b703c6c
commit 5622076820
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
modules/nixos/profiles/system.nix
View File

@ -23,6 +23,7 @@ in {
default = pkgs.wineWowPackages.stable;
};
};
hardened-config.enable = lib.mkEnableOption "hardened configuration primarily intended for servers";
};
config = lib.mkIf cfg.enable (lib.mkMerge [
@ -235,5 +236,31 @@ in {
bottles # PlayOnLinux but better. :>
];
})
# The profile intended to be used for servers.
# Most of the things here are based from the Securing Debian document.
(lib.mkIf cfg.hardened-config.enable {
# Don't replace it mid-way! DON'T TURN LEFT!!!!
security.protectKernelImage = true;
# Hardened config equals hardened kernel.
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_0_hardened;
# Be STRICT! MUAHAHAHAHA!!!!
services.fail2ban = {
enable = true;
bantime-increment = {
enable = true;
factor = "4";
maxtime = "24h";
};
ignoreIP = [ "127.0.0.1/16" ];
};
boot.kernel.sysctl = {
# Disable system console entirely. We don't need it so get rid of it.
"kernel.sysrq" = 0;
};
})
]);
}