summaryrefslogtreecommitdiff
path: root/system/hardened.nix
diff options
context:
space:
mode:
authorFreya Murphy <freya@freyacat.org>2026-01-26 08:06:19 -0500
committerFreya Murphy <freya@freyacat.org>2026-01-26 08:06:19 -0500
commit351d76d05ac4cd67866fa2005ee4501a2b14e6a7 (patch)
tree8a6cce571bdb88792645fb78c487ab4888864d0e /system/hardened.nix
parentmodify firefox stuff (diff)
downloaddotfiles-nix-351d76d05ac4cd67866fa2005ee4501a2b14e6a7.tar.gz
dotfiles-nix-351d76d05ac4cd67866fa2005ee4501a2b14e6a7.tar.bz2
dotfiles-nix-351d76d05ac4cd67866fa2005ee4501a2b14e6a7.zip
update commits and remove unused modules/inputs
Diffstat (limited to 'system/hardened.nix')
-rw-r--r--system/hardened.nix58
1 files changed, 0 insertions, 58 deletions
diff --git a/system/hardened.nix b/system/hardened.nix
deleted file mode 100644
index 223b358..0000000
--- a/system/hardened.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{
- lib,
- config,
- inputs,
- ...
-}: let
- inherit (lib) mkIf;
-in {
- imports = [
- inputs.nix-mineral.nixosModules.nix-mineral
- ];
-
- config = mkIf config.hardened {
- nix-mineral = {
- enable = true;
- settings = {
- debug = {
- coredump = true;
- zram = false;
- };
- network = {
- icmp = {
- cast = true;
- ignore-all = false;
- };
- };
- kernel = {
- cpu-mitigations = "smt-on";
- io-uring = true;
- lockdown = true;
- only-signed-modules = true;
- pti = true;
- sysrq = "none";
- };
- system = {
- yama = "relaxed";
- };
- };
- extras = {
- kernel = {
- intelme-kmodules = false;
- };
- system = {
- secure-chrony = true;
- unprivileged-userns = false;
- };
- };
- filesystems = {
- normal = {
- # let me run shell scripts
- # please and thank you
- "/home".options.noexec = lib.mkForce false;
- "/etc".options.noexec = lib.mkForce true;
- };
- };
- };
- };
-}