oysteikt/nix-dotfiles
oysteikt/nix-dotfiles
2
1
Fork 0
Code Issues Pull Requests Activity

tsuki: fixes for nixos 24.11

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit 2024-11-18 15:18:52 +01:00
parent a4cc770a08
commit dc79a237b3
Signed by: oysteikt
GPG Key ID: 9F2F7D8250F35146
3 changed files with 16 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
hosts/tsuki/services/postgres.nix
View File

@ -48,32 +48,7 @@ in {
requires = [ "postgresql.service" ];
};
systemd.services.postgresql = {
serviceConfig = {
Restart = "always";
RestartSec = 3;
ReadWritePaths = [ cfg.dataDir ];
NoNewPrivileges = true;
PrivateDevices = true;
ProtectClock = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
# PrivateMounts = true;
RestrictSUIDSGID = true;
ProtectHostname = true;
LockPersonality = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
ProtectProc = "invisible";
ProtectHome = true;
# PrivateNetwork = true;
PrivateUsers = true;
PrivateTmp = true;
UMask = "0077";
# RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
SystemCallArchitectures = "native";
};
};
systemd.services.postgresql.serviceConfig.ReadWritePaths = [ cfg.dataDir ];
environment.systemPackages = [ config.services.postgresql.package ];
}

42
hosts/tsuki/services/samba.nix
View File

@ -5,26 +5,25 @@
enable = true;
# openFirewall = true;
extraConfig = ''
workgroup = TSUKI
server string = smbnix
netbios name = smbnix
settings = {
global = {
"workgroup" = "TSUKI";
"server string" = "smbnix";
"netbios name" = "smbnix";
security = user
"security" = "user";
use sendfile = yes
min protocol = SMB2
smb encrypt = desired
"use sendfile" = "yes";
"min protocol" = "SMB2";
"smb encrypt" = "desired";
# note: localhost is the ipv6 localhost ::1
hosts allow = 100.107.69.8 100.100.65.88
hosts deny = 0.0.0.0/0
# note: localhost is the ipv6 localhost ::1
"hosts allow" = "100.107.69.8 100.100.65.88";
"hosts deny" = "0.0.0.0/0";
guest ok = no
map to guest = never
'';
shares = {
"guest ok" = "no";
"map to guest" = "never";
};
cirno = {
path = "/data/cirno";
browseable = "yes";
@ -66,15 +65,4 @@
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 139 445 ];
networking.firewall.interfaces."tailscale0".allowedUDPPorts = [ 137 138 ];
systemd.slices.system-samba = {
description = "Samba slice";
after = [ "system.slice" ];
requires = [ "system.slice" ];
};
systemd.services.samba-smbd.serviceConfig.Slice = "system-samba.slice";
systemd.services.samba-nmbd.serviceConfig.Slice = "system-samba.slice";
systemd.services.samba-winbindd.serviceConfig.Slice = "system-samba.slice";
}

33
hosts/tsuki/services/vaultwarden.nix
View File

@ -21,39 +21,6 @@ in {
systemd.services.vaultwarden = lib.mkIf cfg.enable {
requires = [ "postgresql.service" ];
serviceConfig = {
# Extra hardening
CapabilityBoundingSet = "";
LockPersonality = true;
NoNewPrivileges = true;
# MemoryDenyWriteExecute = true;
PrivateMounts = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RemoveIPC = true;
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
UMask = "0007";
};
};
services.postgresql = lib.mkIf cfg.enable {