asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

hardening

Browse source
This commit is contained in:
Sergei Poljanski 2026-01-13 07:07:17 +02:00
commit 5cbce68d88
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
3 changed files with 41 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
configuration.nix
View file

@ -14,6 +14,7 @@
./modules/shell.nix ./modules/shell.nix
./modules/programs.nix ./modules/programs.nix
./modules/wireguard.nix ./modules/wireguard.nix
./modules/security.nix
]; ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
@ -22,5 +23,6 @@
# this value at the release version of the first install of this system. # this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option # Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "25.11"; system.stateVersion = "25.11";
} }

12
flake.lock generated
View file

@ -8,11 +8,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1766457259, "lastModified": 1768271737,
"narHash": "sha256-bDA65v40vYio865H6UplNHbeYhR7/A1GQqKT1u3suAM=", "narHash": "sha256-IE9nsfNUPTksyLzb6ZHqiRPwOIkZ/zXlW0vyCUVhTzk=",
"owner": "sadjow", "owner": "sadjow",
"repo": "claude-code-nix", "repo": "claude-code-nix",
"rev": "5dfa1244dd5e93dd868719e26d80164dd3b0ba00", "rev": "445c54bbb461bb99a1eb9e06248a55da75d9e58d",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -41,11 +41,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1766309749, "lastModified": 1768127708,
"narHash": "sha256-3xY8CZ4rSnQ0NqGhMKAy5vgC+2IVK0NoVEzDoOh4DA4=", "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "a6531044f6d0bef691ea18d4d4ce44d0daa6e816", "rev": "ffbc9f8cbaacfb331b6017d5a5abb21a492c9a38",
"type": "github" "type": "github"
}, },
"original": { "original": {

33
modules/security.nix Normal file
View file

@ -0,0 +1,33 @@
{ config, pkgs, ... }:
{
# Only allow members of the wheel group to execute sudo
security.sudo.execWheelOnly = true;
# Linux Audit Framework (suggested by Lynis)
security.auditd.enable = true;
security.audit.enable = true;
# Kernel Hardening
security.protectKernelImage = true;
# Sysctl hardening
boot.kernel.sysctl = {
# Hide kernel pointers from unprivileged users
"kernel.kptr_restrict" = 1;
# Restrict ptrace to only child processes
"kernel.yama.ptrace_scope" = 1;
# Disable BPF JIT for unprivileged users
"kernel.unprivileged_bpf_disabled" = 1;
# Networking hardening
"net.ipv4.conf.all.log_martians" = 1;
"net.ipv4.conf.all.rp_filter" = 1;
"net.ipv4.conf.default.log_martians" = 1;
"net.ipv4.conf.default.rp_filter" = 1;
"net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv6.conf.default.accept_redirects" = 0;
};
}