From 6368272cdeec8c69800b4e7645402914f48e5c33 Mon Sep 17 00:00:00 2001 From: seth Date: Tue, 9 Jul 2024 06:45:24 -0400 Subject: modules: better document most things --- modules/nixos/base/security.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'modules/nixos/base/security.nix') diff --git a/modules/nixos/base/security.nix b/modules/nixos/base/security.nix index 12d6f7e..5c015c7 100644 --- a/modules/nixos/base/security.nix +++ b/modules/nixos/base/security.nix @@ -6,15 +6,17 @@ in options.base.security = { enable = lib.mkEnableOption "basic security settings" // { default = config.base.enable; + defaultText = lib.literalExpression "config.base.enable"; }; }; + # much here is sourced from https://xeiaso.net/blog/paranoid-nixos-2021-07-18/ config = lib.mkIf cfg.enable { security = { apparmor.enable = lib.mkDefault true; - audit.enable = lib.mkDefault true; - auditd.enable = lib.mkDefault true; - polkit.enable = lib.mkDefault true; + audit.enable = lib.mkDefault true; # TODO: do i really need to set this manually? + auditd.enable = lib.mkDefault true; # ditto + polkit.enable = lib.mkDefault true; # ditto sudo.execWheelOnly = true; }; -- cgit v1.2.3