diff options
| author | Freya Murphy <freya@freyacat.org> | 2026-01-26 08:06:19 -0500 |
|---|---|---|
| committer | Freya Murphy <freya@freyacat.org> | 2026-01-26 08:06:19 -0500 |
| commit | 351d76d05ac4cd67866fa2005ee4501a2b14e6a7 (patch) | |
| tree | 8a6cce571bdb88792645fb78c487ab4888864d0e /system/hardened.nix | |
| parent | modify firefox stuff (diff) | |
| download | dotfiles-nix-351d76d05ac4cd67866fa2005ee4501a2b14e6a7.tar.gz dotfiles-nix-351d76d05ac4cd67866fa2005ee4501a2b14e6a7.tar.bz2 dotfiles-nix-351d76d05ac4cd67866fa2005ee4501a2b14e6a7.zip | |
update commits and remove unused modules/inputs
Diffstat (limited to '')
| -rw-r--r-- | system/hardened.nix | 58 |
1 files changed, 0 insertions, 58 deletions
diff --git a/system/hardened.nix b/system/hardened.nix deleted file mode 100644 index 223b358..0000000 --- a/system/hardened.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ - lib, - config, - inputs, - ... -}: let - inherit (lib) mkIf; -in { - imports = [ - inputs.nix-mineral.nixosModules.nix-mineral - ]; - - config = mkIf config.hardened { - nix-mineral = { - enable = true; - settings = { - debug = { - coredump = true; - zram = false; - }; - network = { - icmp = { - cast = true; - ignore-all = false; - }; - }; - kernel = { - cpu-mitigations = "smt-on"; - io-uring = true; - lockdown = true; - only-signed-modules = true; - pti = true; - sysrq = "none"; - }; - system = { - yama = "relaxed"; - }; - }; - extras = { - kernel = { - intelme-kmodules = false; - }; - system = { - secure-chrony = true; - unprivileged-userns = false; - }; - }; - filesystems = { - normal = { - # let me run shell scripts - # please and thank you - "/home".options.noexec = lib.mkForce false; - "/etc".options.noexec = lib.mkForce true; - }; - }; - }; - }; -} |