atridad/lavitz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1766606163

Browse Source
This commit is contained in:
Atridad Lahiji
2025-12-24 12:56:03 -07:00
parent 72afd43933
commit a479ec48f8
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
configuration.nix
View File

@@ -3,7 +3,7 @@
{ {
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
# Import Modules # Import Modules
./modules/boot.nix ./modules/boot.nix
./modules/networking.nix ./modules/networking.nix

2
modules/security.nix
View File

@@ -17,7 +17,6 @@
security.apparmor = { security.apparmor = {
enable = true; enable = true;
killUnconfinedConfinables = true;
}; };
services.fail2ban = { services.fail2ban = {
@@ -50,7 +49,6 @@
"kernel.kptr_restrict" = 2; "kernel.kptr_restrict" = 2;
"kernel.perf_event_paranoid" = 3; "kernel.perf_event_paranoid" = 3;
"kernel.yama.ptrace_scope" = 1; "kernel.yama.ptrace_scope" = 1;
"kernel.unprivileged_bpf_disabled" = 1;
"kernel.sysrq" = 0; "kernel.sysrq" = 0;
"kernel.randomize_va_space" = 2; "kernel.randomize_va_space" = 2;
"kernel.kexec_load_disabled" = 1; "kernel.kexec_load_disabled" = 1;

6
modules/services.nix
View File

@@ -11,13 +11,13 @@
PasswordAuthentication = false; PasswordAuthentication = false;
KbdInteractiveAuthentication = false; KbdInteractiveAuthentication = false;
PermitEmptyPasswords = false; PermitEmptyPasswords = false;
# Security hardening # Security hardening
X11Forwarding = false; X11Forwarding = false;
AllowTcpForwarding = false; AllowTcpForwarding = false;
AllowAgentForwarding = false; AllowAgentForwarding = false;
AllowStreamLocalForwarding = false; AllowStreamLocalForwarding = false;
# Session settings # Session settings
ClientAliveInterval = 300; ClientAliveInterval = 300;
ClientAliveCountMax = 2; ClientAliveCountMax = 2;
@@ -57,4 +57,6 @@
services.avahi.publish.enable = true; services.avahi.publish.enable = true;
services.avahi.publish.userServices = true; services.avahi.publish.userServices = true;
services.gnome.gnome-remote-desktop.enable = true;
} }