diff options
Diffstat (limited to 'system/hardened.nix')
| -rw-r--r-- | system/hardened.nix | 58 |
1 files changed, 0 insertions, 58 deletions
diff --git a/system/hardened.nix b/system/hardened.nix deleted file mode 100644 index 223b358..0000000 --- a/system/hardened.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ - lib, - config, - inputs, - ... -}: let - inherit (lib) mkIf; -in { - imports = [ - inputs.nix-mineral.nixosModules.nix-mineral - ]; - - config = mkIf config.hardened { - nix-mineral = { - enable = true; - settings = { - debug = { - coredump = true; - zram = false; - }; - network = { - icmp = { - cast = true; - ignore-all = false; - }; - }; - kernel = { - cpu-mitigations = "smt-on"; - io-uring = true; - lockdown = true; - only-signed-modules = true; - pti = true; - sysrq = "none"; - }; - system = { - yama = "relaxed"; - }; - }; - extras = { - kernel = { - intelme-kmodules = false; - }; - system = { - secure-chrony = true; - unprivileged-userns = false; - }; - }; - filesystems = { - normal = { - # let me run shell scripts - # please and thank you - "/home".options.noexec = lib.mkForce false; - "/etc".options.noexec = lib.mkForce true; - }; - }; - }; - }; -} |