mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-08-27 05:23:56 +02:00
ryan4yin | 二花
21d64e7add
* security: make firewall secure-by-default, disable explicitly on servers
Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.
* test: fix security-firewall eval test to scalar per-host values
* security: enable AppArmor (complain) on all Linux hosts
* security: bind aquamarine metrics exporters to loopback
* security: restrict k3s kubeconfig file mode to 600
* security: disable SSH X11 forwarding on servers, keep on desktops
* security: add conservative systemd hardening to aquamarine services
* docs(apparmor): correct FHS-alias comment (nixpkgs has no broad FHS layer)
nixpkgs only creates /run/current-system, /usr/bin/env and /bin/sh; it does not
provide a broad FHS->store alias tree, so FHS-oriented abstractions are incomplete
on NixOS. They are safe only because the profiles run in complain mode.
* fix(aquamarine): scrape same-host exporters over loopback
The v2ray/postgres/sftpgo exporters were bound to 127.0.0.1 but VictoriaMetrics
scraped them via the host's routable IP, so those scrapes refused connections.
Point the three same-host scrape targets at 127.0.0.1 (VM runs on the same host).
node-exporter keeps the host IP since it binds 0.0.0.0.
* Revert "security: add conservative systemd hardening to aquamarine services"
This reverts commit f9cf99dadb.
NixOS / Nix-Darwin's Submodules
This directory contains modular NixOS and Nix-Darwin configurations organized by platform and functionality.
Current Structure
modules/
├── README.md
├── base/ # Common configuration for all platforms
│ ├── default.nix
│ ├── fonts.nix # System font configuration
│ ├── nix.nix # Nix package manager settings
│ ├── overlays.nix # Package overlays
│ ├── security.nix # Basic security settings
│ ├── system-packages.nix # Essential system packages
│ └── users.nix # User management
├── darwin/ # macOS-specific modules
│ ├── README.md
│ ├── apps.nix # macOS applications
│ ├── broken-packages.nix # Package compatibility fixes
│ ├── default.nix
│ ├── nix-core.nix # Core Nix configuration
│ ├── security.nix # macOS security settings
│ ├── ssh.nix # SSH configuration
│ ├── system.nix # System-level settings
│ └── users.nix # macOS user management
└── nixos/ # NixOS-specific modules
├── base/ # Base NixOS configuration
│ ├── btrbk.nix # Backup configuration
│ ├── core.nix # Core system settings
│ ├── default.nix
│ ├── i18n.nix # Internationalization
│ ├── monitoring.nix # System monitoring
│ ├── networking.nix # Network configuration
│ ├── nix.nix # Nix settings
│ ├── packages.nix # System packages
│ ├── remote-building.nix # Remote build setup
│ ├── ssh.nix # SSH daemon configuration
│ ├── user-group.nix # User and group management
│ └── zram.nix # ZRAM swap configuration
├── desktop.nix # Desktop environment configuration
├── desktop/ # Desktop-specific modules
│ ├── default.nix
│ ├── fhs.nix # FHS environment
│ ├── fonts.nix # Desktop fonts
│ ├── guix.nix # GNU Guix integration
│ ├── misc.nix # Miscellaneous desktop settings
│ ├── networking/ # Network-related desktop configs
│ │ ├── clash-verge.nix
│ │ ├── default.nix
│ │ ├── remote-desktop.nix
│ │ └── tailscale.nix
│ ├── peripherals.nix # Peripheral device configuration
│ ├── security.nix # Desktop security settings
│ ├── virtualisation.nix # Virtualization support
│ └── xdg.nix # XDG base directory settings
└── server/ # Server-specific modules
├── kubevirt-hardware-configuration.nix
├── server-aarch64.nix
├── server-riscv64.nix
└── server.nix
Module Categories
1. Base Modules (base/)
Common configuration shared between NixOS and macOS:
- System fonts and localization
- Essential packages and tools
- Basic security settings
- User management
- Package overlays
2. macOS Modules (darwin/)
macOS-specific configuration:
- macOS applications and system settings
- Security configurations tailored for macOS
- SSH and system-level settings
- Package compatibility fixes
3. NixOS Modules (nixos/)
Platform-specific NixOS configuration:
- Base: Core system settings and services
- Desktop: Desktop environment and GUI applications
- Server: Server-specific optimizations and services
Usage
Modules are imported based on platform detection:
- NixOS Systems: Import
nixos/modules - macOS Systems: Import
darwin/modules - All Systems: Import
base/modules for shared configuration
Architecture Support
- x86_64-linux: Desktop and server configurations
- aarch64-linux: ARM64 Linux systems
- aarch64-darwin: Apple Silicon macOS systems
- server-riscv64: RISC-V server configurations