122 lines
3.6 KiB
Nix
122 lines
3.6 KiB
Nix
{
|
||
config,
|
||
lib,
|
||
pkgs,
|
||
...
|
||
}: {
|
||
# Boot
|
||
boot = {
|
||
loader.grub = {
|
||
enable = true;
|
||
device = "/dev/nvme0n1";
|
||
useOSProber = true;
|
||
};
|
||
initrd = {
|
||
availableKernelModules = ["xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod"];
|
||
kernelModules = [];
|
||
};
|
||
kernelModules = ["kvm-intel" "tcp_bbr" "coretemp" "nct6775"];
|
||
kernelParams = ["threadirqs"];
|
||
extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
|
||
|
||
kernel.sysctl = {
|
||
# The Magic SysRq key is a key combo that allows users connected to the
|
||
# system console of a Linux kernel to perform some low-level commands.
|
||
# Disable it, since we don't need it, and is a potential security concern.
|
||
"kernel.sysrq" = 0;
|
||
|
||
## TCP hardening
|
||
# Prevent bogus ICMP errors from filling up logs.
|
||
"net.ipv4.icmp_ignore_bogus_error_responses" = 1;
|
||
# Reverse path filtering causes the kernel to do source validation of
|
||
# packets received from all interfaces. This can mitigate IP spoofing.
|
||
"net.ipv4.conf.default.rp_filter" = 1;
|
||
"net.ipv4.conf.all.rp_filter" = 1;
|
||
# Do not accept IP source route packets
|
||
"net.ipv4.conf.all.accept_source_route" = 1;
|
||
"net.ipv4.conf.wlo1.accept_source_route" = 1;
|
||
"net.ipv6.conf.all.accept_source_route" = 1;
|
||
# Don't send ICMP redirects
|
||
"net.ipv4.conf.all.send_redirects" = 0;
|
||
"net.ipv4.conf.default.send_redirects" = 0;
|
||
# Refuse ICMP redirects (MITM mitigations)
|
||
"net.ipv4.conf.all.accept_redirects" = 0;
|
||
"net.ipv4.conf.default.accept_redirects" = 0;
|
||
"net.ipv4.conf.all.secure_redirects" = 0;
|
||
"net.ipv4.conf.default.secure_redirects" = 0;
|
||
"net.ipv6.conf.all.accept_redirects" = 0;
|
||
"net.ipv6.conf.default.accept_redirects" = 0;
|
||
# Protects against SYN flood attacks
|
||
"net.ipv4.tcp_syncookies" = 1;
|
||
# Incomplete protection again TIME-WAIT assassination
|
||
"net.ipv4.tcp_rfc1337" = 1;
|
||
|
||
## TCP optimization
|
||
# TCP Fast Open is a TCP extension that reduces network latency by packing
|
||
# data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for
|
||
# both incoming and outgoing connections:
|
||
"net.ipv4.tcp_fastopen" = 3;
|
||
# Bufferbloat mitigations + slight improvement in throughput & latency
|
||
"net.ipv4.tcp_congestion_control" = "bbr";
|
||
"net.core.default_qdisc" = "cake";
|
||
};
|
||
};
|
||
|
||
fileSystems."/" = {
|
||
device = "/dev/disk/by-label/nixos";
|
||
fsType = "ext4";
|
||
};
|
||
|
||
swapDevices = [];
|
||
|
||
services.fstrim.enable = true;
|
||
|
||
security = {
|
||
protectKernelImage = true;
|
||
sudo.extraConfig = ''Defaults timestamp_timeout=30'';
|
||
rtkit.enable = true;
|
||
polkit.enable = true;
|
||
};
|
||
|
||
# Hardware etc
|
||
hardware = {
|
||
cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||
|
||
graphics.enable = true;
|
||
graphics.enable32Bit = true;
|
||
|
||
bluetooth.enable = true;
|
||
|
||
pulseaudio.enable = false;
|
||
};
|
||
|
||
networking = {
|
||
networkmanager = {
|
||
enable = true;
|
||
enableStrongSwan = true;
|
||
packages = with pkgs; [
|
||
networkmanager-l2tp
|
||
];
|
||
};
|
||
hostName = "nixos";
|
||
extraHosts = ''192.168.130.211 gitlab'';
|
||
};
|
||
|
||
time.timeZone = "Asia/Yekaterinburg";
|
||
|
||
i18n = {
|
||
defaultLocale = "en_US.UTF-8";
|
||
extraLocaleSettings = {
|
||
LC_ADDRESS = "en_US.UTF-8";
|
||
LC_IDENTIFICATION = "en_US.UTF-8";
|
||
LC_MEASUREMENT = "en_US.UTF-8";
|
||
LC_MONETARY = "en_US.UTF-8";
|
||
LC_NAME = "en_US.UTF-8";
|
||
LC_NUMERIC = "en_US.UTF-8";
|
||
LC_PAPER = "en_US.UTF-8";
|
||
LC_TELEPHONE = "en_US.UTF-8";
|
||
LC_TIME = "en_US.UTF-8";
|
||
};
|
||
};
|
||
}
|