From 5ec7ee21e036f7bc1cbdec714271c619cb3fdb3d Mon Sep 17 00:00:00 2001
From: seth <getchoo@tuta.io>
Date: Sun, 27 Oct 2024 20:12:19 -0400
Subject: modules: restructure (#487)

* seth: remove unused pkgs

* modules: restructure

from archetypes back to profiles
make less actual modules for everything
use lib.mkDefault like it's supposed to
move mixins out of server

* nixos/resolved: use modern options
---
 modules/nixos/defaults/security.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 modules/nixos/defaults/security.nix

(limited to 'modules/nixos/defaults/security.nix')

diff --git a/modules/nixos/defaults/security.nix b/modules/nixos/defaults/security.nix
new file mode 100644
index 0000000..65ce729
--- /dev/null
+++ b/modules/nixos/defaults/security.nix
@@ -0,0 +1,13 @@
+# Much of this is sourced from https://xeiaso.net/blog/paranoid-nixos-2021-07-18/
+{ lib, ... }:
+{
+  security = {
+    apparmor.enable = lib.mkDefault true;
+    audit.enable = lib.mkDefault true;
+    auditd.enable = lib.mkDefault true;
+    polkit.enable = true;
+    sudo.execWheelOnly = true;
+  };
+
+  services.dbus.apparmor = lib.mkDefault "enabled";
+}
-- 
cgit v1.2.3