kore

kore / nixos / features / global.nix90 lines · 1730B · raw
1{ inputs, outputs, lib, pkgs, ... }:
2
3{
4  i18n.defaultLocale = "en_US.UTF-8";
5  time.timeZone = "UTC";
6
7  nix = {
8    package = pkgs.nixVersions.latest;
9
10    gc = {
11      automatic = true;
12      dates = "weekly";
13      options = "--delete-older-than 7d";
14    };
15
16    settings = {
17      keep-outputs = false;
18      keep-derivations = false;
19      auto-optimise-store = true;
20
21      trusted-users = [ "@wheel" ];
22      experimental-features = [ "nix-command" "flakes" ];
23    };
24  };
25
26  nixpkgs = {
27    overlays = builtins.attrValues outputs.overlays;
28
29    config = {
30      allowUnfree = lib.mkForce false;
31      allowBroken = lib.mkForce false;
32    };
33  };
34
35  networking = {
36    domain = "lostduk.com";
37
38    useDHCP = true;
39    enableIPv6 = lib.mkForce false;
40
41    firewall = {
42      enable = lib.mkForce true;
43      allowPing = lib.mkForce false;
44      allowedTCPPorts = [];
45      allowedUDPPorts = [];
46    };
47  };
48
49  services = {
50    pcscd.enable = true;
51
52    openssh = {
53      enable = true;
54      settings = {
55        PermitRootLogin = "no";
56        PasswordAuthentication = false;
57        KbdInteractiveAuthentication = false;
58      };
59      hostKeys = [{
60        path = "/persist/etc/ssh/ssh_host_ed25519_key";
61        type = "ed25519";
62      }];
63    };
64  };
65
66  security = {
67    protectKernelImage = true;
68
69    audit = {
70      enable = true;
71      rules = [ "-a exit,always, -F arch=b64 -S execve" ];
72    };
73
74    sudo = {
75      execWheelOnly = true;
76      wheelNeedsPassword = lib.mkForce true;
77    };
78
79    auditd.enable = true;
80    pam.enableSSHAgentAuth = true;
81  };
82
83  users = {
84    mutableUsers = lib.mkForce false;
85
86    users.root.hashedPassword = lib.mkForce "!";
87  };
88
89  environment.defaultPackages = lib.mkForce [];
90}