Add noexec & size=25% to tmpfs on /tmp

Also auto-enable boot.cleanTmpDir if boot.tmpOnTmpfs is off. /tmp
shouldn't be treated as persistent storage!

hosts/ao/default.nix

@@ -28,7 +28,6 @@ with lib.my;
     theme.active = "alucard";
   };
 
-
   ## Local config
   networking.networkmanager.enable = true;
 

modules/security.nix

@@ -1,8 +1,21 @@
-{ ... }:
+{ lib, config, ... }:
 
 {
   ## System security tweaks
-  boot.tmpOnTmpfs = true;
+  # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy
+  # on ssd systems, and volatile! Because it's wiped on reboot.
+  boot.tmpOnTmpfs = lib.mkDefault true;
+  systemd.mounts = lib.mkIf config.boot.tmpOnTmpfs [{
+    what = "tmpfs";
+    where = "/tmp";
+    type = "tmpfs";
+    # Added noexec (for added security), and reduced size from 50% to 25%
+    options = "mode=1777,strictatime,rw,nosuid,nodev,noexec,size=25%";
+  }];
+  # If not using tmpfs, which is naturally purged on reboot, we must clean it
+  # /tmp ourselves. /tmp should be volatile storage!
+  boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs);
+
   security.hideProcessInformation = true;
   security.protectKernelImage = true;