harden

features/server/devserver.nix

@@ -2,5 +2,4 @@
   environment.systemPackages = with pkgs; [
     nodejs-14_x # Need this for https://nixos.wiki/wiki/Vscode
   ];
-
 }

features/server/harden.nix

@@ -0,0 +1,22 @@
+{ pkgs, ... }: {
+
+  networking.firewall.enable = true;
+  security.sudo.execWheelOnly = true;
+  security.auditd.enable = true;
+  security.audit.enable = true;
+  services = {
+    openssh = {
+      enable = true;
+      permitRootLogin = "prohibit-password"; # distributed-build.nix requires it
+      passwordAuthentication = false;
+      allowSFTP = false;
+    };
+    fail2ban = {
+      enable = true;
+      ignoreIP = [
+        # quebec
+        "70.53.187.43"
+      ];
+    };
+  };
+}

flake.nix

@@ -82,7 +82,8 @@
         nixosConfigurations.ryzen9 = mkHomeMachine
           ./hosts/ryzen9.nix
           [
-            ./features/devserver-mode.nix
+            ./features/server/harden.nix
+            ./features/server/devserver.nix
           ];
       };
 

hosts/ryzen9.nix

@@ -106,25 +106,12 @@
     extraOptions = ''
       experimental-features = nix-command flakes
     '';
+    allowedUsers = [ "root" "srid" ];
     trustedUsers = [ "root" "srid" ];
   };
 
-  services = {
-    openssh = {
-      enable = true;
-      permitRootLogin = "prohibit-password"; # distributed-build.nix requires it
-      passwordAuthentication = false;
-    };
-    fail2ban = {
-      enable = true;
-      ignoreIP = [
-        # quebec
-        "70.53.187.43"
-      ];
-    };
 
-    netdata.enable = true;
-  };
+  services.netdata.enable = true;
 
   programs = {
     mosh.enable = true;
@@ -139,11 +126,6 @@
     isNormalUser = true;
     extraGroups = [ "wheel" "networkmanager" "adbusers" "audio" ];
   };
-  # Open ports in the firewall.
-  # networking.firewall.allowedTCPPorts = [ ... ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions