ashisgreat22
58905b7666
- Enable firewall with only SSH port 22 open, disable ping - Harden SSH: disable root login and password auth - Create non-root user 'ashie' with sudo access - Add htop and tmux to system packages - Enable automatic NixOS updates (no auto-reboot) - Fix hostname syntax error (missing closing quote) - Remove duplicate nixos/ subdirectory Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
61 lines
1.3 KiB
Nix
61 lines
1.3 KiB
Nix
{ config, pkgs, lib, ... }: {
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
];
|
|
|
|
# Workaround for https://github.com/NixOS/nix/issues/8502
|
|
services.logrotate.checkConfig = false;
|
|
|
|
boot.tmp.cleanOnBoot = true;
|
|
zramSwap.enable = true;
|
|
networking.hostName = "nixos";
|
|
networking.domain = "";
|
|
|
|
# === Firewall ===
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 22 ]; # SSH
|
|
allowPing = false;
|
|
};
|
|
|
|
# === SSH Hardening ===
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PermitRootLogin = "no";
|
|
PasswordAuthentication = false;
|
|
};
|
|
};
|
|
|
|
# === User Account ===
|
|
users.users.ashie = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII0OjmlFPbz/H0sv+Y7L+rHR7KCD9lL7HIevEnqy48qH ashisgreat22@github.com"
|
|
];
|
|
};
|
|
|
|
# === Sudo without password for wheel group ===
|
|
security.sudo.wheelNeedsPassword = false;
|
|
|
|
# === Automatic Updates ===
|
|
system.autoUpgrade = {
|
|
enable = true;
|
|
allowReboot = false;
|
|
};
|
|
|
|
system.stateVersion = "23.11";
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
vim
|
|
wget
|
|
git
|
|
nano
|
|
kitty.terminfo
|
|
htop
|
|
tmux
|
|
];
|
|
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
}
|