Ryan Yin
72a6e95cab
security: make firewall secure-by-default, disable explicitly on servers
...
Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.
2026-08-26 18:14:43 +08:00
Ryan Yin
0fe12bef5a
fix(nix): preserve default sandbox shell
...
Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap.
Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net.
Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
2026-07-06 23:04:16 +08:00
Ryan Yin
8462d34ade
feat: NixOS tests using systemd-nspawn containers
2026-06-22 09:02:06 +08:00
Ryan Yin
400725b36c
chore: replace nixos-generators image outputs
2026-06-14 14:10:08 +08:00
Ryan Yin
8207ccbdff
refactor(home): consolidate host home modules under home/hosts
2026-03-23 12:38:55 +08:00
Ryan Yin
cf7b5a5be7
refactor(home): move host home-manager configs out of hosts
2026-03-23 10:57:09 +08:00
Ryan Yin
69f77fecca
feat: new host - idols-akane, hardens VFAT /boot mounts ( #245 )
...
* feat: new host - idols-akane
* fix: missing efi files
* fix: efi partition - permission issue
2026-03-07 23:54:13 +08:00
Ryan Yin
fb7a0cd178
feat: replace waybar/mako/anyrun/wlogout/swaylock with noctolia-shell, remove hyprland ( #240 )
2026-01-03 09:36:54 -06:00
Ryan Yin
29760ddb27
refactor: update niri, write config in kdl, remove niri-flake ( #237 )
...
• Updated input 'nixpkgs':
→ 'github:NixOS/nixpkgs/0254eab410b90ef2420c1059f908ae777e3b02f9?narHash=sha256-/US2Ei9JHXHVBAxV4FX49Q7H5s4UNBrIiOA6Xjzgq44%3D' (2025-12-06)
• Updated input 'home-manager':
'github:nix-community/home-manager/f4cb25928fafa9ae68660fe71f730fc820a59028?narHash=sha256-5xOuutXM7UPTUcn3uDAD8UlPQsXmqPrX81cXoDOAGcA%3D' (2025-11-26)
→ 'github:nix-community/home-manager/89c9508bbe9b40d36b3dc206c2483ef176f15173?narHash=sha256-rB45jv4uwC90vM9UZ70plfvY/2Kdygs%2BzlQ07dGQFk4%3D' (2025-12-17)
• Updated input 'nixpkgs-master':
'github:nixos/nixpkgs/6812bcfd614abedbdb3f68d7b6554eda6ca3e014?narHash=sha256-sNF/PZcuzYBHKRBkerEiPf5mkZM15A3fWD%2BlqpwKc60%3D' (2025-12-15)
→ 'github:nixos/nixpkgs/e50ab9bb181f9fb3ce00e7a6007c70ddaa007203?narHash=sha256-acPMRCAPgPykzkwATwD1EfF7xgmbraAvIJyCeR6bKxc%3D' (2025-12-18)
Signed-off-by: Ryan Yin <xiaoyin_c@qq.com >
2025-12-18 19:56:46 -06:00
Ryan Yin
070aeae8db
feat: gaming ( #223 )
...
* refactor: configure gaming suite via options, use pkgs-x64
* fix: gaming on apple silicon (not work yet)
2025-09-17 13:54:27 +08:00
Ryan Yin
ce4588d0c2
feat: niri - define configs via home-manager
2025-08-20 01:59:42 +08:00
Ryan Yin
69eee64e7e
feat: add new wayland compositor - niri
2025-08-20 00:03:25 +08:00
Ryan Yin
13bb77108c
feat: format via 'ls **/*.nix | each { |it| nixfmt $it.name }'
2025-07-30 12:17:24 +08:00
Ryan Yin
ae0158b226
fix: shoukei - allowUnsupportedSstem
2025-07-13 02:42:32 +08:00
Ryan Yin
264611e334
fix: shoukei - hardening
2025-07-13 02:12:24 +08:00
Ryan Yin
db82d2d8c5
feat: remove x86_64-darwin, add new nixos host on macbook pro m2
2025-07-12 23:30:52 +08:00
Ryan Yin
35eb6ed5c9
refactor: migrate sbcs to https://github.com/ryan4yin/nixos-config-sbc
2024-08-16 15:06:24 +08:00
Ryan Yin
b671c05db9
feat: migrate services to aqua
2024-07-31 14:29:21 +08:00
Ryan Yin
f831061889
feat: add private ca for all internal web services
2024-04-03 16:51:51 +08:00
Ryan Yin
347ae9d4b1
feat: add home-manager for rakushun
2024-04-01 15:14:54 +08:00
Ryan Yin
bf6bc4bee2
feat: migrate all nixos services from idols to 12kingdoms
2024-03-31 16:50:17 +08:00
Ryan Yin
53d3901e9a
feat: dae - arm64 microvm
2024-03-26 00:35:18 +08:00
Ryan Yin
e5606b6619
fix(tests): error: attribute 'rk3588' missing
2024-03-25 00:21:53 +08:00
Ryan Yin
7d577713bb
feat(outputs/*/tests): add kernel tests
2024-03-24 23:53:53 +08:00
Ryan Yin
6a9afbb9a2
fix: rename unitTests to evalTests
2024-03-13 21:48:09 +08:00
Ryan Yin
a79a64beaf
refactor: rename colmena-meta to colmenaMeta
2024-03-13 18:17:48 +08:00
Ryan Yin
fff6ad6bff
feat: unit tests
2024-03-13 16:44:41 +08:00
Ryan Yin
b382999a70
refactor: Use haumea for filesystem-based module system for flake outputs
...
refactor: Use hyphen(`-`) for variable names & folder names(except Python), replace all unserscore(`_`) with hyphen(`-`).
2024-03-10 20:12:02 +08:00
Ryan Yin