mirror of
https://github.com/Nexoniarz/nexoniarz-config-nixos.git
synced 2026-11-03 04:24:27 +00:00
aae40e6d5c
system.nix had grown to 200 lines covering boot, networking, locale, audio, Bluetooth, fonts, nix settings, hardening, DNS and RGB. Split it by concern into boot.nix, networking.nix, locale.nix, nix-settings.nix, security.nix and audio.nix. Also: - drivers.nix -> hardware.nix, absorbing Bluetooth, the I2C udev rule, OpenRGB and printing - fonts -> desktop.nix - nix-ld and pkgs.file -> apps.nix - the Bottles tmpfiles link -> users.nix, next to services.flatpak The reorganization is behavior-neutral: the dbus-1, system-units, user-units and system-path trees are byte-identical to the previous build once self-referential store paths are normalized, and `nix store diff-closures` against the running system reports exactly one change -- go 1.26.7. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
38 lines
1,015 B
Nix
38 lines
1,015 B
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
security.polkit.enable = true;
|
|
|
|
security.sudo.extraConfig = ''
|
|
Defaults pwfeedback
|
|
'';
|
|
|
|
programs.firejail.enable = true;
|
|
|
|
programs.gnupg.agent = {
|
|
enable = true;
|
|
enableSSHSupport = true;
|
|
pinentryPackage = pkgs.pinentry-rofi;
|
|
};
|
|
|
|
boot.kernel.sysctl = {
|
|
"kernel.kptr_restrict" = 2;
|
|
"kernel.dmesg_restrict" = 1;
|
|
"net.ipv4.conf.all.rp_filter" = 1;
|
|
"net.ipv4.conf.default.rp_filter" = 1;
|
|
"net.ipv4.conf.all.accept_redirects" = false;
|
|
"net.ipv4.conf.default.accept_redirects" = false;
|
|
"net.ipv6.conf.all.accept_redirects" = false;
|
|
"net.ipv6.conf.default.accept_redirects" = false;
|
|
"net.ipv4.conf.all.send_redirects" = false;
|
|
"net.ipv4.conf.default.send_redirects" = false;
|
|
# Only bites ad-hoc `gdb -p <pid>` on a non-child process.
|
|
"kernel.yama.ptrace_scope" = 1;
|
|
"net.ipv4.tcp_timestamps" = 0;
|
|
};
|
|
|
|
systemd.coredump.enable = false;
|
|
security.protectKernelImage = true;
|
|
|
|
services.geoclue2.enable = false;
|
|
}
|