0 Fork 0

mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:36 +01:00

Files

T

Ryan Yin 7dc4e7a39f feat(security): harden homelab SSH, services and audit trail

The homelab hosts accept root SSH with long-lived file keys, run several
exposed services with almost no systemd sandboxing, and keep no audit trail of
privileged actions. Close those three gaps, weighing each measure against its
cost instead of adopting a policy wholesale.

SSH
- Turn off KbdInteractiveAuthentication: nixpkgs defaults it to true and PAM
  then still accepts the Unix password despite PasswordAuthentication = false.
- authorizedKeysInHomedir = false: only keys declared in Nix take effect;
  youko keeps Gitea's forced-command file through `Match User gitea`.
- Pin aquamarine's passphrase-free remote-builder keys to
  `restrict,command="nix-daemon --stdio --store daemon"`, so builds run in the
  system daemon instead of an audited root login session.

systemd sandboxing
- Add the mylib.systemdHardening preset and apply it to the exposed, weakly
  sandboxed services: caddy 7.8 -> 1.5, vmalert 8.2 -> 1.4, rustfs 6.6 -> 1.4,
  whisper-asr 7.7 -> 1.6. An eval test pins the key restrictions.
- Rejected: a global all-keys policy (<=0.2 score gains on services nixpkgs
  already sandboxes) and per-service confinement (bind paths to maintain).

auditd on all four hosts, reusing nixpkgs' loader and unit
- Audit login sessions only: a first `-a never,task -F auid=unset` rule keeps
  services out of the per-syscall audit path. A compromised service is
  therefore unrecorded until it opens a session.
- Record root commands, credential and host-key access, writes to SSH, account,
  PAM, Nix-trust and audit configuration, module loads and session denials.
- Rejected: global denial logging, service-UID watches and
  --loginuid-immutable (the kernel already records loginuid changes).

Verified on all four hosts after deployment: zero failed units, k3s 6/6 Ready,
and the exposed services healthy.

Assisted-by: Claude Code (claude-opus-5-5)

2026-10-31 01:09:15 +08:00

1.6 KiB

Raw Blame History

Library

This directory contains helper functions used by outputs/default.nix (and the installer flake) to reduce code duplication and make it easier to add new machines.

Current Functions

Core System Generators

macosSystem.nix - macOS configuration generator for nix-darwin
nixosSystem.nix - NixOS configuration generator
colmenaSystem.nix - Remote deployment configuration for colmena

Specialized Module Generators

genK3sServerModule.nix - K3s server node configuration generator
genK3sAgentModule.nix - K3s agent/worker node configuration generator
genVmHostModule.nix - physical VM host (bridge + libvirt) configuration generator
genMicrovmGuestModule.nix - NixOS microVM guest configuration generator
genLibvirtDomainXml.nix - libvirt domain XML generator (imported directly by host configs)

Shared Presets

systemdHardening.nix - systemd sandboxing preset for exposed services

Entry Point

default.nix - Main entry point that imports the generators and exports them as a single attribute set, plus the relativeToRoot and scanPaths helpers

Usage

The generators import the shared host modules, so a new machine supplies its own values and system-specific attributes. colmenaSystem covers remote deployment, and genLibvirtDomainXml renders the domain XML for one guest.

Architecture Support

x86_64-linux: Primary desktop systems
aarch64-linux: ARM64 Linux systems (Apple Silicon, SBCs)
aarch64-darwin: Apple Silicon macOS systems

1.6 KiB Raw Blame History