hardening

configuration.nix

@@ -14,6 +14,7 @@
     ./modules/shell.nix
     ./modules/programs.nix
     ./modules/wireguard.nix
+    ./modules/security.nix
   ];
 
   # This value determines the NixOS release from which the default
@@ -22,5 +23,6 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+
   system.stateVersion = "25.11";
 }

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766457259,
-        "narHash": "sha256-bDA65v40vYio865H6UplNHbeYhR7/A1GQqKT1u3suAM=",
+        "lastModified": 1768271737,
+        "narHash": "sha256-IE9nsfNUPTksyLzb6ZHqiRPwOIkZ/zXlW0vyCUVhTzk=",
         "owner": "sadjow",
         "repo": "claude-code-nix",
-        "rev": "5dfa1244dd5e93dd868719e26d80164dd3b0ba00",
+        "rev": "445c54bbb461bb99a1eb9e06248a55da75d9e58d",
         "type": "github"
       },
       "original": {
@@ -41,11 +41,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766309749,
-        "narHash": "sha256-3xY8CZ4rSnQ0NqGhMKAy5vgC+2IVK0NoVEzDoOh4DA4=",
+        "lastModified": 1768127708,
+        "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a6531044f6d0bef691ea18d4d4ce44d0daa6e816",
+        "rev": "ffbc9f8cbaacfb331b6017d5a5abb21a492c9a38",
         "type": "github"
       },
       "original": {

modules/security.nix

@@ -0,0 +1,33 @@
+{ config, pkgs, ... }:
+
+{
+  # Only allow members of the wheel group to execute sudo
+  security.sudo.execWheelOnly = true;
+
+  # Linux Audit Framework (suggested by Lynis)
+  security.auditd.enable = true;
+  security.audit.enable = true;
+
+  # Kernel Hardening
+  security.protectKernelImage = true;
+
+  # Sysctl hardening
+  boot.kernel.sysctl = {
+    # Hide kernel pointers from unprivileged users
+    "kernel.kptr_restrict" = 1;
+
+    # Restrict ptrace to only child processes
+    "kernel.yama.ptrace_scope" = 1;
+
+    # Disable BPF JIT for unprivileged users
+    "kernel.unprivileged_bpf_disabled" = 1;
+
+    # Networking hardening
+    "net.ipv4.conf.all.log_martians" = 1;
+    "net.ipv4.conf.all.rp_filter" = 1;
+    "net.ipv4.conf.default.log_martians" = 1;
+    "net.ipv4.conf.default.rp_filter" = 1;
+    "net.ipv6.conf.all.accept_redirects" = 0;
+    "net.ipv6.conf.default.accept_redirects" = 0;
+  };
+}