asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

podman, opensnitch

Browse source
This commit is contained in:
Sergei Poljanski 2026-01-13 18:10:28 +02:00
commit 654c8a8b72
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
6 changed files with 20 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.gitignore vendored
View file

@ -1 +1 @@
modules/usb-devices.nix
#modules/usb-devices.nix

2
modules/packages.nix
View file

@ -88,7 +88,7 @@
awscli2
# azure-cli
google-cloud-sdk
docker-compose
podman-compose
argocd
fluxcd
kubectx # switch between contexts/namespaces

3
modules/programs.nix
View file

@ -42,7 +42,4 @@
# Virtualization (KVM/QEMU)
virtualisation.libvirtd.enable = true;
programs.virt-manager.enable = true;
# Docker
virtualisation.docker.enable = true;
}

5
modules/security.nix
View file

@ -49,6 +49,9 @@
implicitPolicyTarget = "block";
};
# OpenSnitch Application Firewall
services.opensnitch.enable = true;
security.pam.loginLimits = [
{ domain = "*"; item = "core"; type = "-"; value = "0"; }
];
@ -84,5 +87,7 @@
lynis
audit
tcpdump
bandwhich
opensnitch-ui
];
}

12
modules/usb-devices.nix Normal file
View file

@ -0,0 +1,12 @@
{ ... }:
{
services.usbguard.rules = ''
allow id 1d6b:0002 serial "0000:07:00.3" name "xHCI Host Controller" hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" parent-hash "0ucliRMjldIprxe48uLucRla+MwXWjm3BjOe1IwriL0=" with-interface 09:00:00 with-connect-type ""
allow id 1d6b:0003 serial "0000:07:00.3" name "xHCI Host Controller" hash "O6iOpcl9StImWT62SrbeXacqbG6N/mTIipTRc0ipCGM=" parent-hash "0ucliRMjldIprxe48uLucRla+MwXWjm3BjOe1IwriL0=" with-interface 09:00:00 with-connect-type ""
allow id 1d6b:0002 serial "0000:07:00.4" name "xHCI Host Controller" hash "Hp8B0Enf+ACRT2tyy0EqXj7eNsFDAnTRZadzuh/Iqd4=" parent-hash "yDUn2DiXqqtcIEdDBTvWPAS3N3pEqZ4rLl1feEAXV9U=" with-interface 09:00:00 with-connect-type ""
allow id 1d6b:0003 serial "0000:07:00.4" name "xHCI Host Controller" hash "rJ3LKdvkCK3SUrCU3lV8qVbmPjA+r9Fe5106x2HlgK4=" parent-hash "yDUn2DiXqqtcIEdDBTvWPAS3N3pEqZ4rLl1feEAXV9U=" with-interface 09:00:00 with-connect-type ""
allow id 2357:0604 serial "EC750C9EF6C2" name "TP-Link Bluetooth USB Adapter" hash "8yVJfhZNa1ezefblgi5rzbI/GwSPhCMRRHgbUgMtJ1I=" parent-hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" with-interface { e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 } with-connect-type "hotplug"
allow id 058f:9540 serial "" name "EMV Smartcard Reader" hash "j6z/wqFtA1bZWwBIPmIr/g8KfsEQJ63vpgf4cBcNLbU=" parent-hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" via-port "1-3" with-interface 0b:00:00 with-connect-type "not used"
'';
}

2
modules/users.nix
View file

@ -8,7 +8,7 @@
users.users.asxpi = {
isNormalUser = true;
description = "Sergei P";
extraGroups = [ "networkmanager" "wheel" "dialout" "libvirtd" "docker" ];
extraGroups = [ "networkmanager" "wheel" "dialout" "libvirtd" "podman" ];
shell = pkgs.zsh;
packages = with pkgs; [
# Internet