319 lines
9.3 KiB
Markdown
319 lines
9.3 KiB
Markdown
# NixOS Configuration
|
|
|
|
Personal NixOS configuration with Hyprland, containerized services, and security hardening.
|
|
|
|
> **Note:** Parts of this configuration were created with the assistance of AI tools.
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
# Apply configuration
|
|
doas nixos-rebuild switch --flake ~/nixos#nixos
|
|
|
|
# Update flake inputs
|
|
nix flake update
|
|
|
|
# Test configuration without applying
|
|
doas nixos-rebuild dry-run --flake ~/nixos#nixos
|
|
```
|
|
|
|
## Using These Modules
|
|
|
|
Others can import individual modules from this flake:
|
|
|
|
```nix
|
|
{
|
|
inputs.ashie-nixos.url = "github:ashisgreat22/nixos";
|
|
|
|
outputs = { nixpkgs, ashie-nixos, ... }: {
|
|
nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {
|
|
modules = [
|
|
ashie-nixos.nixosModules.security
|
|
ashie-nixos.nixosModules.kernelHardening
|
|
{
|
|
myModules.security.enable = true;
|
|
myModules.kernelHardening.enable = true;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
}
|
|
```
|
|
|
|
### Available Modules
|
|
|
|
| Module | Description |
|
|
| --------------------------------------- | ------------------------------ |
|
|
| `nixosModules.security` | doas, audit logging, AppArmor |
|
|
| `nixosModules.kernelHardening` | Boot params, sysctl, ZRAM |
|
|
| `nixosModules.dnsOverTls` | DNSSEC + DNS-over-TLS |
|
|
| `nixosModules.cloudflareFirewall` | nftables Cloudflare-only rules |
|
|
| `nixosModules.caddyCloudflare` | Caddy with DNS-01 ACME |
|
|
| `nixosModules.podman` | Podman container runtime |
|
|
| `nixosModules.browserVpn` | VPN-isolated browsers |
|
|
| `homeManagerModules.hyprlandCatppuccin` | Themed Hyprland config |
|
|
| `homeManagerModules.gluetunUser` | Rootless VPN container |
|
|
| `homeManagerModules.qbittorrentVpn` | qBittorrent through VPN |
|
|
|
|
## Structure
|
|
|
|
```
|
|
~/nixos/
|
|
├── configuration.nix # Main config (enables modules via myModules.*)
|
|
├── flake.nix # Flake inputs, outputs, and module exports
|
|
├── hardware-configuration.nix
|
|
├── home.nix # Home Manager entry point
|
|
├── modules/ # Reusable NixOS modules
|
|
│ ├── default.nix # Imports all system modules
|
|
│ ├── system/ # System-level modules
|
|
│ │ ├── security.nix # doas, audit, AppArmor
|
|
│ │ ├── kernel-hardening.nix # Boot params, sysctl, ZRAM
|
|
│ │ ├── dns-over-tls.nix # DNSSEC + DoT
|
|
│ │ ├── cloudflare-firewall.nix # nftables rules
|
|
│ │ ├── caddy-cloudflare.nix # Caddy + DNS-01
|
|
│ │ ├── podman.nix # Container runtime
|
|
│ │ └── browser-vpn.nix # VPN-isolated browsers
|
|
│ └── home/ # Home Manager modules
|
|
│ ├── hyprland-catppuccin.nix
|
|
│ ├── gluetun-user.nix
|
|
│ ├── qbittorrent-vpn.nix
|
|
│ └── browser-container-update.nix
|
|
├── system/ # Host-specific system config
|
|
│ ├── boot.nix # Bootloader
|
|
│ ├── hardware.nix # GPU, USBGuard, fonts
|
|
│ ├── networking.nix # Hostname, ddclient
|
|
│ ├── packages.nix # System packages
|
|
│ ├── services.nix # Steam, Caddy vhosts
|
|
│ └── secrets.nix # SOPS secrets
|
|
├── home/ # Host-specific Home Manager config
|
|
│ ├── fastfetch.nix, kitty.nix, steam.nix, vscode.nix
|
|
├── containers/ # Container Dockerfiles
|
|
│ ├── firefox-wayland/ # Isolated Firefox
|
|
│ ├── thorium-wayland/ # Isolated Thorium
|
|
│ └── tor-browser-wayland/
|
|
├── unified_router/ # API routing service
|
|
├── codex2api/ # Codex API proxy
|
|
├── antigravity-src/ # Antigravity2API source
|
|
└── secrets/ # SOPS-encrypted secrets
|
|
```
|
|
|
|
## Integrated Services
|
|
|
|
### API Ecosystem
|
|
|
|
A microservices architecture for managing LLM interactions:
|
|
|
|
- **Unified Router** (`unified_router/`)
|
|
- **Codex2API** (`codex2api/`)
|
|
- **Antigravity2API** (`antigravity-src/`)
|
|
- **Data Generator** (`scripts/data_generator/`): Tool for generating synthetic training data.
|
|
|
|
### Web Services (via Caddy)
|
|
|
|
| Service | URL | Port |
|
|
| --------------- | --------------------- | ----------- |
|
|
| Open WebUI | `chat.ashisgreat.xyz` | 3000 → 8080 |
|
|
| Unified Router | `api.ashisgreat.xyz` | 6767 |
|
|
| Antigravity2API | (Internal) | 8045 |
|
|
|
|
### Containers
|
|
|
|
```bash
|
|
# View running containers
|
|
podman ps
|
|
|
|
# View container logs
|
|
podman logs open-webui
|
|
podman logs antigravity2api
|
|
```
|
|
|
|
## Isolated Browsers (VPN)
|
|
|
|
Browsers running in containers routed through WireGuard VPN.
|
|
|
|
### Firefox
|
|
|
|
```bash
|
|
# Launch isolated Firefox
|
|
firefox-vpn-podman
|
|
|
|
# Or use commands directly
|
|
firefox-vpn-podman run # Start Firefox
|
|
firefox-vpn-podman stop # Stop containers
|
|
firefox-vpn-podman status # Check status
|
|
firefox-vpn-podman build # Rebuild container image
|
|
```
|
|
|
|
### Tor Browser
|
|
|
|
```bash
|
|
# Launch isolated Tor Browser
|
|
tor-browser-vpn-podman
|
|
|
|
# Or use commands directly
|
|
tor-browser-vpn-podman run # Start Tor Browser
|
|
tor-browser-vpn-podman stop # Stop containers
|
|
tor-browser-vpn-podman status # Check status
|
|
tor-browser-vpn-podman build # Rebuild container image
|
|
```
|
|
|
|
> **Note:** Traffic flows through both the VPN and Tor network for double isolation.
|
|
|
|
### Thorium Browser
|
|
|
|
```bash
|
|
# Launch isolated Thorium Browser
|
|
thorium-vpn-podman
|
|
|
|
# Or use commands directly
|
|
thorium-vpn-podman run # Start Thorium
|
|
thorium-vpn-podman stop # Stop containers
|
|
thorium-vpn-podman status # Check status
|
|
thorium-vpn-podman build # Rebuild container image
|
|
```
|
|
|
|
### Auto-Updates
|
|
|
|
Browser containers are automatically rebuilt weekly via systemd timer.
|
|
|
|
```bash
|
|
# Check timer status
|
|
systemctl --user status browser-containers-update.timer
|
|
|
|
# Manually trigger update
|
|
systemctl --user start browser-containers-update
|
|
|
|
# View update logs
|
|
journalctl --user -u browser-containers-update -n 50
|
|
```
|
|
|
|
## qBittorrent (VPN)
|
|
|
|
User service running through gluetun VPN container.
|
|
|
|
```bash
|
|
# Start/stop
|
|
systemctl --user start qbittorrent
|
|
systemctl --user stop qbittorrent
|
|
|
|
# View status
|
|
systemctl --user status gluetun
|
|
systemctl --user status qbittorrent
|
|
|
|
# Access WebUI (through VPN container)
|
|
# http://127.0.0.1:8080
|
|
```
|
|
|
|
## Secrets Management (SOPS)
|
|
|
|
Secrets are encrypted with AGE and decrypted at activation time.
|
|
|
|
```bash
|
|
# Edit secrets
|
|
sops secrets/secrets.yaml
|
|
|
|
# Add new secret to secrets.nix, then re-encrypt
|
|
sops updatekeys secrets/secrets.yaml
|
|
```
|
|
|
|
## Security Features & Hardening
|
|
|
|
### Kernel Hardening
|
|
|
|
**Boot Parameters** (runtime protection):
|
|
|
|
- `slab_nomerge` - Prevents slab cache merging
|
|
- `init_on_alloc/free=1` - Zeros memory (use-after-free mitigation)
|
|
- `page_alloc.shuffle=1` - Randomizes page allocator
|
|
- `randomize_kstack_offset=on` - Randomizes kernel stack
|
|
- `vsyscall=none` - Disables legacy vsyscall
|
|
- `oops=panic` - Panics on kernel oops
|
|
|
|
**Sysctl Settings**:
|
|
|
|
- `kptr_restrict=2` - Hide kernel pointers
|
|
- `dmesg_restrict=1` - Restrict kernel logs
|
|
- `ptrace_scope=1` - Restrict debugging
|
|
- `unprivileged_bpf_disabled=1` - Disable BPF for users
|
|
|
|
```bash
|
|
# Verify boot params after reboot
|
|
cat /proc/cmdline
|
|
```
|
|
|
|
### Network Security
|
|
|
|
- **DNS-over-TLS (DoT)**: Enabled via `systemd-resolved`. Encrypts all DNS queries to Quad9 and Cloudflare.
|
|
- **Firewall**: `nftables` with Cloudflare-only access on ports 80/443. Direct connections are blocked.
|
|
- **Caddy**: Uses DNS-01 ACME challenge (via Cloudflare API) for SSL certs. Configured with security headers (HSTS, CSP, etc.).
|
|
|
|
### Audit Logging
|
|
|
|
```bash
|
|
# View audit logs
|
|
sudo ausearch -ts today # Today's events
|
|
sudo ausearch -k sudoers # Sudoers changes
|
|
sudo aureport --summary # Summary report
|
|
```
|
|
|
|
### Automatic Updates
|
|
|
|
- Runs daily at 4 AM
|
|
- Downloads updates but doesn't auto-reboot
|
|
- Apply manually: `sudo nixos-rebuild switch --flake ~/nixos#nixos`
|
|
|
|
### Known Security Considerations
|
|
|
|
- **Secrets**: `cloudflare.key` is currently a raw file, not managed by SOPS.
|
|
- **Containers**: Custom service containers may run as root internally.
|
|
|
|
## Useful Commands
|
|
|
|
```bash
|
|
# System
|
|
sudo nixos-rebuild switch --flake ~/nixos#nixos # Apply config
|
|
sudo nixos-rebuild boot --flake ~/nixos#nixos # Apply on next boot
|
|
nix flake update # Update all inputs
|
|
nix-collect-garbage -d # Clean old generations
|
|
|
|
# Containers
|
|
podman system prune -a # Clean unused images
|
|
podman volume ls # List volumes
|
|
|
|
# Firewall
|
|
sudo nft list ruleset # View nftables
|
|
sudo nft list set inet cloudflare cloudflare_ipv4 # View Cloudflare IPs
|
|
|
|
# Logs
|
|
journalctl -u caddy -f # Caddy logs
|
|
journalctl --user -u gluetun -f # VPN logs
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
### Container network issues
|
|
|
|
```bash
|
|
# Recreate podman network
|
|
podman network rm antigravity-net
|
|
sudo systemctl restart podman-network-antigravity-net
|
|
```
|
|
|
|
### Firefox VPN not starting
|
|
|
|
```bash
|
|
# Check gluetun status first
|
|
systemctl --user status gluetun
|
|
journalctl --user -u gluetun -n 50
|
|
|
|
# Rebuild image if needed
|
|
firefox-vpn-podman build
|
|
```
|
|
|
|
### Secrets not decrypting
|
|
|
|
```bash
|
|
# Check SOPS key
|
|
ls -la ~/.config/sops/age/keys.txt
|
|
sops -d secrets/secrets.yaml # Test decryption
|
|
```
|