qbit/xin
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

default: set hardened kernel as default

Browse Source
This commit is contained in:
Aaron Bieber 2022-09-27 09:55:56 -06:00
parent 78b56c7bf4
commit f23aae085a
No known key found for this signature in database
6 changed files with 2 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
default.nix
View File

@ -100,6 +100,8 @@ in {
''; '';
boot.cleanTmpDir = true; boot.cleanTmpDir = true;
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_hardened;
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
age age
apg apg

2
hosts/box/default.nix
View File

@ -96,8 +96,6 @@ in {
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
boot.kernelPackages = pkgs.linuxPackages_hardened;
doas.enable = true; doas.enable = true;
networking.hostName = "box"; networking.hostName = "box";

1
hosts/europa/default.nix
View File

@ -57,7 +57,6 @@ in {
efiSysMountPoint = "/boot/efi"; efiSysMountPoint = "/boot/efi";
}; };
}; };
kernelPackages = pkgs.linuxPackages_hardened;
kernelParams = [ "boot.shell_on_fail" "mem_sleep_default=deep" ]; kernelParams = [ "boot.shell_on_fail" "mem_sleep_default=deep" ];
kernelModules = [ "kvm-intel" ]; kernelModules = [ "kvm-intel" ];
}; };

2
hosts/faf/default.nix
View File

@ -14,8 +14,6 @@ in {
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
boot.kernelPackages = pkgs.linuxPackages_hardened;
boot.supportedFilesystems = [ "zfs" ]; boot.supportedFilesystems = [ "zfs" ];
boot.zfs.devNodes = "/dev/"; boot.zfs.devNodes = "/dev/";

1
hosts/h/default.nix
View File

@ -33,7 +33,6 @@ in {
boot.loader.grub.version = 2; boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/sda"; boot.loader.grub.device = "/dev/sda";
boot.kernelPackages = pkgs.linuxPackages_hardened;
boot.kernelParams = [ "net.ifnames=0" ]; boot.kernelParams = [ "net.ifnames=0" ];
tailscale.sshOnly = true; tailscale.sshOnly = true;

1
hosts/stan/default.nix
View File

@ -29,7 +29,6 @@ in {
"/crypto_keyfile.bin"; "/crypto_keyfile.bin";
secrets = { "/crypto_keyfile.bin" = null; }; secrets = { "/crypto_keyfile.bin" = null; };
}; };
kernelPackages = pkgs.linuxPackages_hardened;
kernelParams = [ "intel_idle.max_cstate=4" ]; kernelParams = [ "intel_idle.max_cstate=4" ];
}; };