Bump
* Updated agenix: github:ryantm/agenix/ed7e69bff3c17671349839f696e88e345eb9eb24 -> github:ryantm/agenix/9eb981eeb552e0856cb562b7643b311933a0e992 * Updated emacs-overlay: github:nix-community/emacs-overlay/063ee066b5095dd2f21f47c582b04024674974a8 -> github:nix-community/emacs-overlay/daa4b15755f6cccb462efed696abceee0994bb96 * Updated home-manager: github:rycee/home-manager/f45c7000d544f17e5499e2ae6b505b5f705c5d61 -> github:rycee/home-manager/040ea28e448a93d24540b7cf2eda4b25300c5ab1 * Updated nixos-hardware: github:nixos/nixos-hardware/c9b965a43e582765f797f8b75d50cb2874b30f30 -> github:nixos/nixos-hardware/831de9cac9ff2ea8cf4c3742020ea92e82ac8ac3 * Updated nixpkgs: github:NixOS/nixpkgs/ff96a0fa5635770390b184ae74debea75c3fd534 -> github:NixOS/nixpkgs/29b0d4d0b600f8f5dd0b86e3362a33d4181938f9 * Updated nixpkgs-unstable: github:NixOS/nixpkgs/07b0c7bc4104b87cb5223ec10e32b863d10768ad -> github:NixOS/nixpkgs/d02b1cc8ed29b6967119fd95267ee1a955015d59 Also, removed noexec from /tmp because it screws with build processes that deploy/execute scripts to/out of /tmp, causing permission errors while building.
This commit is contained in:
		
							parent
							
								
									5d86b2a1a9
								
							
						
					
					
						commit
						51d63a1829
					
				
							
								
								
									
										36
									
								
								flake.lock
									
									
									
									
									
								
							
							
						
						
									
										36
									
								
								flake.lock
									
									
									
									
									
								
							|  | @ -8,11 +8,11 @@ | ||||||
|         ] |         ] | ||||||
|       }, |       }, | ||||||
|       "locked": { |       "locked": { | ||||||
|         "lastModified": 1614302731, |         "lastModified": 1614636489, | ||||||
|         "narHash": "sha256-BlnHbbkf5nl8SvpmkMI1iXYU6UOdrRuJk02MLGsop4s=", |         "narHash": "sha256-VntWWhlx4zvGJVdQet9dTOiC2bBvW1xzDQ9ug1eQ8IQ=", | ||||||
|         "owner": "ryantm", |         "owner": "ryantm", | ||||||
|         "repo": "agenix", |         "repo": "agenix", | ||||||
|         "rev": "ed7e69bff3c17671349839f696e88e345eb9eb24", |         "rev": "9eb981eeb552e0856cb562b7643b311933a0e992", | ||||||
|         "type": "github" |         "type": "github" | ||||||
|       }, |       }, | ||||||
|       "original": { |       "original": { | ||||||
|  | @ -23,11 +23,11 @@ | ||||||
|     }, |     }, | ||||||
|     "emacs-overlay": { |     "emacs-overlay": { | ||||||
|       "locked": { |       "locked": { | ||||||
|         "lastModified": 1613838016, |         "lastModified": 1615496115, | ||||||
|         "narHash": "sha256-4jCxccHv0WF3ciBH5qXO/PWfCiWWpfgdESbiLwc1ooQ=", |         "narHash": "sha256-6FiWzKKSlsKo0zOM2FywSKZpa9xkLeT2CqUudYqCuOE=", | ||||||
|         "owner": "nix-community", |         "owner": "nix-community", | ||||||
|         "repo": "emacs-overlay", |         "repo": "emacs-overlay", | ||||||
|         "rev": "063ee066b5095dd2f21f47c582b04024674974a8", |         "rev": "daa4b15755f6cccb462efed696abceee0994bb96", | ||||||
|         "type": "github" |         "type": "github" | ||||||
|       }, |       }, | ||||||
|       "original": { |       "original": { | ||||||
|  | @ -58,11 +58,11 @@ | ||||||
|         ] |         ] | ||||||
|       }, |       }, | ||||||
|       "locked": { |       "locked": { | ||||||
|         "lastModified": 1614541364, |         "lastModified": 1615419569, | ||||||
|         "narHash": "sha256-mt6BrhjoWXCQPoUinq3htjksSzsFP9eqhahDjpyf+kY=", |         "narHash": "sha256-+ewB0sQGeoYryWZk2Ww2Lm/5jeqhlYTjGy6zEX2Mm1I=", | ||||||
|         "owner": "rycee", |         "owner": "rycee", | ||||||
|         "repo": "home-manager", |         "repo": "home-manager", | ||||||
|         "rev": "f45c7000d544f17e5499e2ae6b505b5f705c5d61", |         "rev": "040ea28e448a93d24540b7cf2eda4b25300c5ab1", | ||||||
|         "type": "github" |         "type": "github" | ||||||
|       }, |       }, | ||||||
|       "original": { |       "original": { | ||||||
|  | @ -74,11 +74,11 @@ | ||||||
|     }, |     }, | ||||||
|     "nixos-hardware": { |     "nixos-hardware": { | ||||||
|       "locked": { |       "locked": { | ||||||
|         "lastModified": 1614460257, |         "lastModified": 1615281383, | ||||||
|         "narHash": "sha256-hFR865O5gIuFNiwFyx/K2g8AeLvGy/f3/SHalF85zuM=", |         "narHash": "sha256-23XBOcZapDtm7IzYYHub4tNpo4AsSz6qLXsHTCNuDAA=", | ||||||
|         "owner": "nixos", |         "owner": "nixos", | ||||||
|         "repo": "nixos-hardware", |         "repo": "nixos-hardware", | ||||||
|         "rev": "c9b965a43e582765f797f8b75d50cb2874b30f30", |         "rev": "831de9cac9ff2ea8cf4c3742020ea92e82ac8ac3", | ||||||
|         "type": "github" |         "type": "github" | ||||||
|       }, |       }, | ||||||
|       "original": { |       "original": { | ||||||
|  | @ -89,11 +89,11 @@ | ||||||
|     }, |     }, | ||||||
|     "nixpkgs": { |     "nixpkgs": { | ||||||
|       "locked": { |       "locked": { | ||||||
|         "lastModified": 1613226215, |         "lastModified": 1615259932, | ||||||
|         "narHash": "sha256-3rA5cGIrBHD6yeKhNhsF7/t461ww25oJY8KyBb0IhjU=", |         "narHash": "sha256-IXecmbqCr+XCtFwzBO3tHEd8PoJ4X4EyPZebKbV2ioE=", | ||||||
|         "owner": "NixOS", |         "owner": "NixOS", | ||||||
|         "repo": "nixpkgs", |         "repo": "nixpkgs", | ||||||
|         "rev": "ff96a0fa5635770390b184ae74debea75c3fd534", |         "rev": "29b0d4d0b600f8f5dd0b86e3362a33d4181938f9", | ||||||
|         "type": "github" |         "type": "github" | ||||||
|       }, |       }, | ||||||
|       "original": { |       "original": { | ||||||
|  | @ -104,11 +104,11 @@ | ||||||
|     }, |     }, | ||||||
|     "nixpkgs-unstable": { |     "nixpkgs-unstable": { | ||||||
|       "locked": { |       "locked": { | ||||||
|         "lastModified": 1614541971, |         "lastModified": 1615521613, | ||||||
|         "narHash": "sha256-PScDWcxCPGH6rB/1Ze6RU9eRhI3KIbfE3k+HQdF7jaI=", |         "narHash": "sha256-D0Pgf7lKBIkWLCC39NR1ge0BT2FRb4pO4K1dPny/OCM=", | ||||||
|         "owner": "NixOS", |         "owner": "NixOS", | ||||||
|         "repo": "nixpkgs", |         "repo": "nixpkgs", | ||||||
|         "rev": "07b0c7bc4104b87cb5223ec10e32b863d10768ad", |         "rev": "d02b1cc8ed29b6967119fd95267ee1a955015d59", | ||||||
|         "type": "github" |         "type": "github" | ||||||
|       }, |       }, | ||||||
|       "original": { |       "original": { | ||||||
|  |  | ||||||
|  | @ -3,20 +3,14 @@ | ||||||
| { | { | ||||||
|   ## System security tweaks |   ## System security tweaks | ||||||
|   # sets hidepid=2 on /proc (make process info visible only to owning user) |   # sets hidepid=2 on /proc (make process info visible only to owning user) | ||||||
|   security.hideProcessInformation = true; |   # NOTE Was removed on nixpkgs-unstable because it doesn't do anything | ||||||
|  |   # security.hideProcessInformation = true; | ||||||
|   # Prevent replacing the running kernel w/o reboot |   # Prevent replacing the running kernel w/o reboot | ||||||
|   security.protectKernelImage = true; |   security.protectKernelImage = true; | ||||||
| 
 | 
 | ||||||
|   # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy |   # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy | ||||||
|   # on ssd systems, and volatile! Because it's wiped on reboot. |   # on ssd systems, and volatile! Because it's wiped on reboot. | ||||||
|   boot.tmpOnTmpfs = lib.mkDefault true; |   boot.tmpOnTmpfs = lib.mkDefault true; | ||||||
|   systemd.mounts = lib.mkIf config.boot.tmpOnTmpfs [{ |  | ||||||
|     what = "tmpfs"; |  | ||||||
|     where = "/tmp"; |  | ||||||
|     type = "tmpfs"; |  | ||||||
|     # Added noexec (for added security) and reduce size from 50% to 25% |  | ||||||
|     options = "mode=1777,strictatime,rw,nosuid,nodev,noexec,size=25%"; |  | ||||||
|   }]; |  | ||||||
|   # If not using tmpfs, which is naturally purged on reboot, we must clean it |   # If not using tmpfs, which is naturally purged on reboot, we must clean it | ||||||
|   # /tmp ourselves. /tmp should be volatile storage! |   # /tmp ourselves. /tmp should be volatile storage! | ||||||
|   boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs); |   boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs); | ||||||
|  |  | ||||||
		Loading…
	
		Reference in a new issue