From 3f72e498d662f59fbb9a2490d2b56115d5469b99 Mon Sep 17 00:00:00 2001
From: Henrik Lissner <henrik@lissner.net>
Date: Sat, 20 Feb 2021 17:53:57 -0500
Subject: [PATCH] hosts/{kuro,shiro}: harden storage/backup mounts

Removing unneeded privileges from backup mounts.

Also adds noatime to nfs mounts for slight improvement in throughput.
---
 hosts/kuro/hardware-configuration.nix  | 10 ++++++++--
 hosts/shiro/hardware-configuration.nix |  5 ++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/hosts/kuro/hardware-configuration.nix b/hosts/kuro/hardware-configuration.nix
index 9a083880..f95eb2e8 100644
--- a/hosts/kuro/hardware-configuration.nix
+++ b/hosts/kuro/hardware-configuration.nix
@@ -75,12 +75,18 @@
     "/usr/drive" = {
       device = "kiiro:/volume1/homes/hlissner/Drive";
       fsType = "nfs";
-      options = [ "nofail" "noauto" "x-systemd.automount" "x-systemd.idle-timeout=5min" ];
+      options = [
+        "nofail" "noauto" "noatime" "x-systemd.automount" "x-systemd.idle-timeout=5min"
+        "nodev" "nosuid" "noexec"
+      ];
     };
     "/usr/store" = {
       device = "/dev/disk/by-label/store";
       fsType = "ext4";
-      options = [ "noauto" "noatime" "x-systemd.automount" "x-systemd.idle-timeout=5min" ];
+      options = [
+        "noauto" "noatime" "x-systemd.automount" "x-systemd.idle-timeout=5min"
+        "nodev" "nosuid" "noexec"
+      ];
     };
   };
   swapDevices = [];
diff --git a/hosts/shiro/hardware-configuration.nix b/hosts/shiro/hardware-configuration.nix
index 91c483e5..1b5f1f28 100644
--- a/hosts/shiro/hardware-configuration.nix
+++ b/hosts/shiro/hardware-configuration.nix
@@ -63,7 +63,10 @@
     "/usr/drive" = {
       device = "kiiro:/volume1/homes/hlissner/Drive";
       fsType = "nfs";
-      options = [ "nofail" "noauto" "x-systemd.automount" ];
+      options = [
+        "nofail" "noauto" "noatime" "x-systemd.automount"
+        "nodev" "nosuid" "noexec"
+      ];
     };
   };
   swapDevices = [ { device = "/dev/disk/by-label/swap"; }];