starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-08-27 05:23:56 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity
Files
21d64e7addb14bdb39ca0c24341317a9b4a80e69
nix-config/hardening
T
History
ryan4yin | 二花 21d64e7add security: hardening pass 1 (AppArmor, firewall default, loopback metrics, k3s perms, SSH X11) (#266) 
* security: make firewall secure-by-default, disable explicitly on servers

Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.

* test: fix security-firewall eval test to scalar per-host values

* security: enable AppArmor (complain) on all Linux hosts

* security: bind aquamarine metrics exporters to loopback

* security: restrict k3s kubeconfig file mode to 600

* security: disable SSH X11 forwarding on servers, keep on desktops

* security: add conservative systemd hardening to aquamarine services

* docs(apparmor): correct FHS-alias comment (nixpkgs has no broad FHS layer)

nixpkgs only creates /run/current-system, /usr/bin/env and /bin/sh; it does not
provide a broad FHS->store alias tree, so FHS-oriented abstractions are incomplete
on NixOS. They are safe only because the profiles run in complain mode.

* fix(aquamarine): scrape same-host exporters over loopback

The v2ray/postgres/sftpgo exporters were bound to 127.0.0.1 but VictoriaMetrics
scraped them via the host's routable IP, so those scrapes refused connections.
Point the three same-host scrape targets at 127.0.0.1 (VM runs on the same host).
node-exporter keeps the host IP since it binds 0.0.0.0.

* Revert "security: add conservative systemd hardening to aquamarine services"

This reverts commit f9cf99dadb.
2026-08-27 00:13:01 +08:00
..
apparmor
security: hardening pass 1 (AppArmor, firewall default, loopback metrics, k3s perms, SSH X11) (#266)
2026-08-27 00:13:01 +08:00
bwraps
feat(bwraps): update wechat to 4.1.1.8
2026-08-25 13:41:34 +08:00
nixpaks
fix(nixpaks): route qq via pkgs-master for 3.2.32-2026-08-12
2026-08-18 09:59:45 +08:00
profiles
feat: format via 'ls **/*.nix | each { |it| nixfmt $it.name }'
2025-07-30 12:17:24 +08:00
README.md
feat: nixpak telegram-desktop, move data to flatpak's appDataDir ~/.var
2025-09-19 00:32:10 +08:00

README.md

Linux Hardening

Work in progress.

Goal

  • System Level: Protect critical files from being accessed by untrusted applications.
    1. Such as browser cookies, SSH keys, etc.
  • Per-App Level: Prevent untrusted applications(such as closed-source apps) from:
    1. Accessing files they shouldn't.
      • Such as a malicious application accessing your browser's cookies, SSH Keys, etc.
    2. Accessing the network when they don't need to.
    3. Accessing hardware devices they don't need.

Current Structure

1. System Level

  • AppArmor (apparmor/): AppArmor profiles and configuration
  • Kernel & System Hardening (profiles/): System-wide hardening profiles

2. Per-App Level

  • Nixpak (nixpaks/): Bubblewrap-based sandboxing for applications
    • Firefox configuration
    • QQ (Chinese messaging app) configuration
    • Modular system with reusable components
  • Firejail (legacy): SUID-based sandboxing (not used)
  • Bubblewrap (bwraps/): Direct bubblewrap configurations
    • WeChat sandboxing configuration

Current Implementation Status

Component Status Notes
AppArmor Profiles 🚧 WIP Basic structure in place
Nixpak Firefox ✅ Active Firefox sandboxing via nixpak
Nixpak QQ ✅ Active QQ application sandboxing
Bubblewrap WeChat ✅ Active WeChat specific sandboxing
System Profiles 🚧 WIP Hardened system configurations

Directory Structure

hardening/
├── README.md
├── apparmor/           # AppArmor security profiles
│   └── default.nix
├── bwraps/            # Direct bubblewrap configurations
│   ├── default.nix
│   └── wechat.nix
├── nixpaks/           # Nixpak application sandboxing
│   ├── default.nix
│   ├── firefox.nix
│   ├── qq.nix
│   └── modules/       # Reusable nixpak modules
│       ├── gui-base.nix
│       └── network.nix
└── profiles/          # System hardening profiles
    └── default.nix

Kernel Hardening

System Hardening

Application Sandboxing

NOTE

Running untrusted code is never safe, kernel hardening & sandboxing cannot change this.

If you want to run untrusted code, please use a VM & an isolated network environment, which will provide a much higher level of security.

References

Reference in New Issue View Git Blame Copy Permalink