starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-09-10 03:51:46 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(security): tighten desktop remote access

Browse Source
This commit is contained in:
Ryan Yin
2026-09-01 20:20:51 +08:00
parent 13436c0c31
commit f766dcc24f
9 changed files with 39 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
outputs/aarch64-linux/tests/security-ssh-x11/expected.nix
+8 -1
View File
@@ -3,5 +3,12 @@
outputs,
}:
lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
name: name == "ai-niri" || name == "shoukei-niri"
name:
let
isDesktop = name == "ai-niri" || name == "shoukei-niri";
in
{
X11Forwarding = isDesktop;
PermitRootLogin = if isDesktop then "no" else "prohibit-password";
}
)
outputs/aarch64-linux/tests/security-ssh-x11/expr.nix
+7 -1
View File
@@ -3,5 +3,11 @@
outputs,
}:
lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
name: outputs.nixosConfigurations.${name}.config.services.openssh.settings.X11Forwarding
name:
let
settings = outputs.nixosConfigurations.${name}.config.services.openssh.settings;
in
{
inherit (settings) PermitRootLogin X11Forwarding;
}
)
outputs/x86_64-linux/tests/idols-ai-gpu/expected.nix
+2 -1
View File
@@ -2,7 +2,8 @@
loadsVirtualDisplay = true;
createsVirtualDisplay = true;
niriUsesIntelRenderer = true;
sunshineUserHasInputAccess = true;
sunshineUserHasInputAccess = false;
sunshineHasSysAdmin = false;
sunshineStartsAfterNiri = true;
sunshineWaitsForNiriOutput = true;
}
outputs/x86_64-linux/tests/idols-ai-gpu/expr.nix
+1
View File
@@ -12,6 +12,7 @@ in
createsVirtualDisplay = lib.hasInfix "options vkms create_default_dev=1" cfg.boot.extraModprobeConfig;
niriUsesIntelRenderer = lib.hasInfix "/dev/dri/by-path/pci-0000:00:02.0-render" niriHardware;
sunshineUserHasInputAccess = builtins.elem "input" cfg.users.users.ryan.extraGroups;
sunshineHasSysAdmin = cfg.services.sunshine.capSysAdmin;
sunshineStartsAfterNiri = builtins.elem "niri.service" cfg.systemd.user.services.sunshine.after;
sunshineWaitsForNiriOutput = lib.hasInfix "niri msg outputs" cfg.systemd.user.services.sunshine.preStart;
}
outputs/x86_64-linux/tests/security-ssh-x11/expected.nix
+8 -1
View File
@@ -3,5 +3,12 @@
outputs,
}:
lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
name: name == "ai-niri" || name == "shoukei-niri"
name:
let
isDesktop = name == "ai-niri" || name == "shoukei-niri";
in
{
X11Forwarding = isDesktop;
PermitRootLogin = if isDesktop then "no" else "prohibit-password";
}
)
outputs/x86_64-linux/tests/security-ssh-x11/expr.nix
+7 -1
View File
@@ -3,5 +3,11 @@
outputs,
}:
lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
name: outputs.nixosConfigurations.${name}.config.services.openssh.settings.X11Forwarding
name:
let
settings = outputs.nixosConfigurations.${name}.config.services.openssh.settings;
in
{
inherit (settings) PermitRootLogin X11Forwarding;
}
)