security: hardening pass 1 (AppArmor, firewall default, loopback metrics, k3s perms, SSH X11) (#266)

* security: make firewall secure-by-default, disable explicitly on servers

Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.

* test: fix security-firewall eval test to scalar per-host values

* security: enable AppArmor (complain) on all Linux hosts

* security: bind aquamarine metrics exporters to loopback

* security: restrict k3s kubeconfig file mode to 600

* security: disable SSH X11 forwarding on servers, keep on desktops

* security: add conservative systemd hardening to aquamarine services

* docs(apparmor): correct FHS-alias comment (nixpkgs has no broad FHS layer)

nixpkgs only creates /run/current-system, /usr/bin/env and /bin/sh; it does not
provide a broad FHS->store alias tree, so FHS-oriented abstractions are incomplete
on NixOS. They are safe only because the profiles run in complain mode.

* fix(aquamarine): scrape same-host exporters over loopback

The v2ray/postgres/sftpgo exporters were bound to 127.0.0.1 but VictoriaMetrics
scraped them via the host's routable IP, so those scrapes refused connections.
Point the three same-host scrape targets at 127.0.0.1 (VM runs on the same host).
node-exporter keeps the host IP since it binds 0.0.0.0.

* Revert "security: add conservative systemd hardening to aquamarine services"

This reverts commit f9cf99dadb.

modules/nixos/base/default.nix

@@ -1,4 +1,4 @@
 { mylib, ... }:
 {
-  imports = mylib.scanPaths ./.;
+  imports = mylib.scanPaths ./. ++ [ (mylib.relativeToRoot "hardening/apparmor") ];
 }

modules/nixos/base/ssh.nix

@@ -1,12 +1,15 @@
 { lib, ... }:
 {
-  # Or disable the firewall altogether.
-  networking.firewall.enable = lib.mkDefault false;
+  # Secure by default: firewall ON everywhere unless a host explicitly disables it
+  # (servers disable it in modules/nixos/server/{server,server-aarch64}.nix).
+  networking.firewall.enable = lib.mkDefault true;
   # Enable the OpenSSH daemon.
   services.openssh = {
     enable = true;
     settings = {
-      X11Forwarding = true;
+      # Secure by default: X11 forwarding off everywhere; desktops re-enable it
+      # in modules/nixos/desktop/ssh.nix (needed for GUI forwarding).
+      X11Forwarding = lib.mkDefault false;
       # root user is used for remote deployment, so we need to allow it
       PermitRootLogin = "prohibit-password";
       PasswordAuthentication = false; # disable password login

modules/nixos/desktop/ssh.nix

@@ -0,0 +1,5 @@
+{
+  # Desktops keep X11 forwarding (current behavior, needed for GUI forwarding);
+  # servers default to off (see modules/nixos/base/ssh.nix).
+  services.openssh.settings.X11Forwarding = true;
+}

modules/nixos/server/server-aarch64.nix

@@ -1,6 +1,7 @@
 {
   lib,
   pkgs,
+  mylib,
   ...
 }:
 {
@@ -15,8 +16,15 @@
     ../base/user-group.nix
 
     ../../base
+    # AppArmor is wired via modules/nixos/base/default.nix for other hosts; this
+    # aarch64 server imports base files individually, so add it explicitly.
+    (mylib.relativeToRoot "hardening/apparmor")
   ];
 
+  # Servers run on the trusted internal LAN (NAT'd; WAN protected at the router).
+  # Keep the firewall off here; the secure default is ON (see modules/nixos/base/ssh.nix).
+  networking.firewall.enable = false;
+
   # Fix: jasper is marked as broken, refusing to evaluate.
   environment.enableAllTerminfo = lib.mkForce false;
 }

modules/nixos/server/server.nix

@@ -4,4 +4,8 @@
     ../base
     ../../base
   ];
+
+  # Servers run on the trusted internal LAN (NAT'd; WAN protected at the router).
+  # Keep the firewall off here; the secure default is ON (see modules/nixos/base/ssh.nix).
+  networking.firewall.enable = false;
 }