aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

Bump

Browse source 
* Updated agenix: github:ryantm/agenix/ed7e69bff3c17671349839f696e88e345eb9eb24 -> github:ryantm/agenix/9eb981eeb552e0856cb562b7643b311933a0e992
* Updated emacs-overlay: github:nix-community/emacs-overlay/063ee066b5095dd2f21f47c582b04024674974a8 -> github:nix-community/emacs-overlay/daa4b15755f6cccb462efed696abceee0994bb96
* Updated home-manager: github:rycee/home-manager/f45c7000d544f17e5499e2ae6b505b5f705c5d61 -> github:rycee/home-manager/040ea28e448a93d24540b7cf2eda4b25300c5ab1
* Updated nixos-hardware: github:nixos/nixos-hardware/c9b965a43e582765f797f8b75d50cb2874b30f30 -> github:nixos/nixos-hardware/831de9cac9ff2ea8cf4c3742020ea92e82ac8ac3
* Updated nixpkgs: github:NixOS/nixpkgs/ff96a0fa5635770390b184ae74debea75c3fd534 -> github:NixOS/nixpkgs/29b0d4d0b600f8f5dd0b86e3362a33d4181938f9
* Updated nixpkgs-unstable: github:NixOS/nixpkgs/07b0c7bc4104b87cb5223ec10e32b863d10768ad -> github:NixOS/nixpkgs/d02b1cc8ed29b6967119fd95267ee1a955015d59

Also, removed noexec from /tmp because it screws with build processes
that deploy/execute scripts to/out of /tmp, causing permission errors
while building.
This commit is contained in:
Henrik Lissner 2021-03-11 23:21:57 -05:00
parent 5d86b2a1a9
commit 51d63a1829
2 changed files with 20 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
flake.lock
View file

@ -8,11 +8,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1614302731, "lastModified": 1614636489,
"narHash": "sha256-BlnHbbkf5nl8SvpmkMI1iXYU6UOdrRuJk02MLGsop4s=", "narHash": "sha256-VntWWhlx4zvGJVdQet9dTOiC2bBvW1xzDQ9ug1eQ8IQ=",
"owner": "ryantm", "owner": "ryantm",
"repo": "agenix", "repo": "agenix",
"rev": "ed7e69bff3c17671349839f696e88e345eb9eb24", "rev": "9eb981eeb552e0856cb562b7643b311933a0e992",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -23,11 +23,11 @@
}, },
"emacs-overlay": { "emacs-overlay": {
"locked": { "locked": {
"lastModified": 1613838016, "lastModified": 1615496115,
"narHash": "sha256-4jCxccHv0WF3ciBH5qXO/PWfCiWWpfgdESbiLwc1ooQ=", "narHash": "sha256-6FiWzKKSlsKo0zOM2FywSKZpa9xkLeT2CqUudYqCuOE=",
"owner": "nix-community", "owner": "nix-community",
"repo": "emacs-overlay", "repo": "emacs-overlay",
"rev": "063ee066b5095dd2f21f47c582b04024674974a8", "rev": "daa4b15755f6cccb462efed696abceee0994bb96",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -58,11 +58,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1614541364, "lastModified": 1615419569,
"narHash": "sha256-mt6BrhjoWXCQPoUinq3htjksSzsFP9eqhahDjpyf+kY=", "narHash": "sha256-+ewB0sQGeoYryWZk2Ww2Lm/5jeqhlYTjGy6zEX2Mm1I=",
"owner": "rycee", "owner": "rycee",
"repo": "home-manager", "repo": "home-manager",
"rev": "f45c7000d544f17e5499e2ae6b505b5f705c5d61", "rev": "040ea28e448a93d24540b7cf2eda4b25300c5ab1",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -74,11 +74,11 @@
}, },
"nixos-hardware": { "nixos-hardware": {
"locked": { "locked": {
"lastModified": 1614460257, "lastModified": 1615281383,
"narHash": "sha256-hFR865O5gIuFNiwFyx/K2g8AeLvGy/f3/SHalF85zuM=", "narHash": "sha256-23XBOcZapDtm7IzYYHub4tNpo4AsSz6qLXsHTCNuDAA=",
"owner": "nixos", "owner": "nixos",
"repo": "nixos-hardware", "repo": "nixos-hardware",
"rev": "c9b965a43e582765f797f8b75d50cb2874b30f30", "rev": "831de9cac9ff2ea8cf4c3742020ea92e82ac8ac3",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -89,11 +89,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1613226215, "lastModified": 1615259932,
"narHash": "sha256-3rA5cGIrBHD6yeKhNhsF7/t461ww25oJY8KyBb0IhjU=", "narHash": "sha256-IXecmbqCr+XCtFwzBO3tHEd8PoJ4X4EyPZebKbV2ioE=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "ff96a0fa5635770390b184ae74debea75c3fd534", "rev": "29b0d4d0b600f8f5dd0b86e3362a33d4181938f9",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -104,11 +104,11 @@
}, },
"nixpkgs-unstable": { "nixpkgs-unstable": {
"locked": { "locked": {
"lastModified": 1614541971, "lastModified": 1615521613,
"narHash": "sha256-PScDWcxCPGH6rB/1Ze6RU9eRhI3KIbfE3k+HQdF7jaI=", "narHash": "sha256-D0Pgf7lKBIkWLCC39NR1ge0BT2FRb4pO4K1dPny/OCM=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "07b0c7bc4104b87cb5223ec10e32b863d10768ad", "rev": "d02b1cc8ed29b6967119fd95267ee1a955015d59",
"type": "github" "type": "github"
}, },
"original": { "original": {

10
modules/security.nix
View file

@ -3,20 +3,14 @@
{ {
## System security tweaks ## System security tweaks
# sets hidepid=2 on /proc (make process info visible only to owning user) # sets hidepid=2 on /proc (make process info visible only to owning user)
security.hideProcessInformation = true; # NOTE Was removed on nixpkgs-unstable because it doesn't do anything
# security.hideProcessInformation = true;
# Prevent replacing the running kernel w/o reboot # Prevent replacing the running kernel w/o reboot
security.protectKernelImage = true; security.protectKernelImage = true;
# tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy
# on ssd systems, and volatile! Because it's wiped on reboot. # on ssd systems, and volatile! Because it's wiped on reboot.
boot.tmpOnTmpfs = lib.mkDefault true; boot.tmpOnTmpfs = lib.mkDefault true;
systemd.mounts = lib.mkIf config.boot.tmpOnTmpfs [{
what = "tmpfs";
where = "/tmp";
type = "tmpfs";
# Added noexec (for added security) and reduce size from 50% to 25%
options = "mode=1777,strictatime,rw,nosuid,nodev,noexec,size=25%";
}];
# If not using tmpfs, which is naturally purged on reboot, we must clean it # If not using tmpfs, which is naturally purged on reboot, we must clean it
# /tmp ourselves. /tmp should be volatile storage! # /tmp ourselves. /tmp should be volatile storage!
boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs); boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs);