Bump
* Updated agenix: github:ryantm/agenix/ed7e69bff3c17671349839f696e88e345eb9eb24 -> github:ryantm/agenix/9eb981eeb552e0856cb562b7643b311933a0e992 * Updated emacs-overlay: github:nix-community/emacs-overlay/063ee066b5095dd2f21f47c582b04024674974a8 -> github:nix-community/emacs-overlay/daa4b15755f6cccb462efed696abceee0994bb96 * Updated home-manager: github:rycee/home-manager/f45c7000d544f17e5499e2ae6b505b5f705c5d61 -> github:rycee/home-manager/040ea28e448a93d24540b7cf2eda4b25300c5ab1 * Updated nixos-hardware: github:nixos/nixos-hardware/c9b965a43e582765f797f8b75d50cb2874b30f30 -> github:nixos/nixos-hardware/831de9cac9ff2ea8cf4c3742020ea92e82ac8ac3 * Updated nixpkgs: github:NixOS/nixpkgs/ff96a0fa5635770390b184ae74debea75c3fd534 -> github:NixOS/nixpkgs/29b0d4d0b600f8f5dd0b86e3362a33d4181938f9 * Updated nixpkgs-unstable: github:NixOS/nixpkgs/07b0c7bc4104b87cb5223ec10e32b863d10768ad -> github:NixOS/nixpkgs/d02b1cc8ed29b6967119fd95267ee1a955015d59 Also, removed noexec from /tmp because it screws with build processes that deploy/execute scripts to/out of /tmp, causing permission errors while building.
This commit is contained in:
		
							parent
							
								
									5d86b2a1a9
								
							
						
					
					
						commit
						51d63a1829
					
				
							
								
								
									
										36
									
								
								flake.lock
									
									
									
									
									
								
							
							
						
						
									
										36
									
								
								flake.lock
									
									
									
									
									
								
							|  | @ -8,11 +8,11 @@ | |||
|         ] | ||||
|       }, | ||||
|       "locked": { | ||||
|         "lastModified": 1614302731, | ||||
|         "narHash": "sha256-BlnHbbkf5nl8SvpmkMI1iXYU6UOdrRuJk02MLGsop4s=", | ||||
|         "lastModified": 1614636489, | ||||
|         "narHash": "sha256-VntWWhlx4zvGJVdQet9dTOiC2bBvW1xzDQ9ug1eQ8IQ=", | ||||
|         "owner": "ryantm", | ||||
|         "repo": "agenix", | ||||
|         "rev": "ed7e69bff3c17671349839f696e88e345eb9eb24", | ||||
|         "rev": "9eb981eeb552e0856cb562b7643b311933a0e992", | ||||
|         "type": "github" | ||||
|       }, | ||||
|       "original": { | ||||
|  | @ -23,11 +23,11 @@ | |||
|     }, | ||||
|     "emacs-overlay": { | ||||
|       "locked": { | ||||
|         "lastModified": 1613838016, | ||||
|         "narHash": "sha256-4jCxccHv0WF3ciBH5qXO/PWfCiWWpfgdESbiLwc1ooQ=", | ||||
|         "lastModified": 1615496115, | ||||
|         "narHash": "sha256-6FiWzKKSlsKo0zOM2FywSKZpa9xkLeT2CqUudYqCuOE=", | ||||
|         "owner": "nix-community", | ||||
|         "repo": "emacs-overlay", | ||||
|         "rev": "063ee066b5095dd2f21f47c582b04024674974a8", | ||||
|         "rev": "daa4b15755f6cccb462efed696abceee0994bb96", | ||||
|         "type": "github" | ||||
|       }, | ||||
|       "original": { | ||||
|  | @ -58,11 +58,11 @@ | |||
|         ] | ||||
|       }, | ||||
|       "locked": { | ||||
|         "lastModified": 1614541364, | ||||
|         "narHash": "sha256-mt6BrhjoWXCQPoUinq3htjksSzsFP9eqhahDjpyf+kY=", | ||||
|         "lastModified": 1615419569, | ||||
|         "narHash": "sha256-+ewB0sQGeoYryWZk2Ww2Lm/5jeqhlYTjGy6zEX2Mm1I=", | ||||
|         "owner": "rycee", | ||||
|         "repo": "home-manager", | ||||
|         "rev": "f45c7000d544f17e5499e2ae6b505b5f705c5d61", | ||||
|         "rev": "040ea28e448a93d24540b7cf2eda4b25300c5ab1", | ||||
|         "type": "github" | ||||
|       }, | ||||
|       "original": { | ||||
|  | @ -74,11 +74,11 @@ | |||
|     }, | ||||
|     "nixos-hardware": { | ||||
|       "locked": { | ||||
|         "lastModified": 1614460257, | ||||
|         "narHash": "sha256-hFR865O5gIuFNiwFyx/K2g8AeLvGy/f3/SHalF85zuM=", | ||||
|         "lastModified": 1615281383, | ||||
|         "narHash": "sha256-23XBOcZapDtm7IzYYHub4tNpo4AsSz6qLXsHTCNuDAA=", | ||||
|         "owner": "nixos", | ||||
|         "repo": "nixos-hardware", | ||||
|         "rev": "c9b965a43e582765f797f8b75d50cb2874b30f30", | ||||
|         "rev": "831de9cac9ff2ea8cf4c3742020ea92e82ac8ac3", | ||||
|         "type": "github" | ||||
|       }, | ||||
|       "original": { | ||||
|  | @ -89,11 +89,11 @@ | |||
|     }, | ||||
|     "nixpkgs": { | ||||
|       "locked": { | ||||
|         "lastModified": 1613226215, | ||||
|         "narHash": "sha256-3rA5cGIrBHD6yeKhNhsF7/t461ww25oJY8KyBb0IhjU=", | ||||
|         "lastModified": 1615259932, | ||||
|         "narHash": "sha256-IXecmbqCr+XCtFwzBO3tHEd8PoJ4X4EyPZebKbV2ioE=", | ||||
|         "owner": "NixOS", | ||||
|         "repo": "nixpkgs", | ||||
|         "rev": "ff96a0fa5635770390b184ae74debea75c3fd534", | ||||
|         "rev": "29b0d4d0b600f8f5dd0b86e3362a33d4181938f9", | ||||
|         "type": "github" | ||||
|       }, | ||||
|       "original": { | ||||
|  | @ -104,11 +104,11 @@ | |||
|     }, | ||||
|     "nixpkgs-unstable": { | ||||
|       "locked": { | ||||
|         "lastModified": 1614541971, | ||||
|         "narHash": "sha256-PScDWcxCPGH6rB/1Ze6RU9eRhI3KIbfE3k+HQdF7jaI=", | ||||
|         "lastModified": 1615521613, | ||||
|         "narHash": "sha256-D0Pgf7lKBIkWLCC39NR1ge0BT2FRb4pO4K1dPny/OCM=", | ||||
|         "owner": "NixOS", | ||||
|         "repo": "nixpkgs", | ||||
|         "rev": "07b0c7bc4104b87cb5223ec10e32b863d10768ad", | ||||
|         "rev": "d02b1cc8ed29b6967119fd95267ee1a955015d59", | ||||
|         "type": "github" | ||||
|       }, | ||||
|       "original": { | ||||
|  |  | |||
|  | @ -3,20 +3,14 @@ | |||
| { | ||||
|   ## System security tweaks | ||||
|   # sets hidepid=2 on /proc (make process info visible only to owning user) | ||||
|   security.hideProcessInformation = true; | ||||
|   # NOTE Was removed on nixpkgs-unstable because it doesn't do anything | ||||
|   # security.hideProcessInformation = true; | ||||
|   # Prevent replacing the running kernel w/o reboot | ||||
|   security.protectKernelImage = true; | ||||
| 
 | ||||
|   # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy | ||||
|   # on ssd systems, and volatile! Because it's wiped on reboot. | ||||
|   boot.tmpOnTmpfs = lib.mkDefault true; | ||||
|   systemd.mounts = lib.mkIf config.boot.tmpOnTmpfs [{ | ||||
|     what = "tmpfs"; | ||||
|     where = "/tmp"; | ||||
|     type = "tmpfs"; | ||||
|     # Added noexec (for added security) and reduce size from 50% to 25% | ||||
|     options = "mode=1777,strictatime,rw,nosuid,nodev,noexec,size=25%"; | ||||
|   }]; | ||||
|   # If not using tmpfs, which is naturally purged on reboot, we must clean it | ||||
|   # /tmp ourselves. /tmp should be volatile storage! | ||||
|   boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs); | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue