asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity
nixOS/modules
History
Exact
Sergei Poljanski 35f3e4cec1
 security: distrust two Mozilla root CAs 
Blacklist "Comodo AAA Services root" and "emSign ECC Root CA - G3"
so they are left out of /etc/ssl/certs/ca-certificates.crt.

Mozilla already distrusted the Comodo root for serverAuth (it was only
trusted for email), so emSign ECC G3 is the only root this removes for
TLS. Apps that ship their own trust store (NSS in browsers, certifi,
Java cacerts) are not affected.

Assisted-by: Claude:opus-5-5
2026-10-21 13:52:31 +04:00
..
boot.nix boot: switch to the latest kernel for the NPU 2026-10-20 20:37:11 +04:00
desktop.nix desktop: point the mutter touch patch at upstream !5375 2026-10-13 08:24:00 +04:00
gaming.nix gaming: enable gamescope 2026-07-11 22:36:01 +04:00
hostel-wifi.nix xray: config via sops, private routes spliced into sing-box at runtime 2026-07-14 12:24:33 +04:00
lemonade.nix lemonade: XDNA2 NPU LLM serving via nix-amd-ai 2026-07-11 22:36:00 +04:00
litecoin-pkg.nix litecoin: build against the default openssl 2026-10-20 20:36:55 +04:00
litecoin.nix litecoin: build against the default openssl 2026-10-20 20:36:55 +04:00
locale.nix timezones now managed by GNOME 2026-03-19 19:14:48 +03:00
networking.nix networking: recover the WWAN modem after a cold boot 2026-10-20 20:37:11 +04:00
ollama.nix ollama: model store to /mnt/data, gfx1151 rocBLAS workaround, load tuning 2026-07-11 22:36:00 +04:00
packages.nix packages: add forgejo-cli 2026-10-20 20:37:11 +04:00
power.nix power: update resume_offset for the current swapfile 2026-10-20 12:10:06 +04:00
programs.nix programs: use the GNOME pinentry for gpg-agent 2026-10-13 08:24:00 +04:00
security.nix security: distrust two Mozilla root CAs 2026-10-21 13:52:31 +04:00
shell.nix shell: drop the nrs alias 2026-10-20 12:10:05 +04:00
sops.nix sops: introduce sops-nix (age), ssh keys from encrypted tarball, .example secrets 2026-07-14 12:24:21 +04:00
users.nix Xray + system-wide proxy config. Fuck Turkey DPI :3 2026-04-06 01:56:55 +03:00
wireguard.nix wireguard: wg0/wg2 configs from sops 2026-07-14 12:24:33 +04:00
xfce-x11-test.nix desktop: add an xfce-x11 boot specialisation 2026-10-20 12:10:06 +04:00
xray.nix xray: config via sops, private routes spliced into sing-box at runtime 2026-07-14 12:24:33 +04:00