daniel/dotfiles
1
0
Fork 0
Code Activity Actions

Compare commits

base: daniel:a2fd00475441fd015cab297cada362784319ed07
Branches Tags
daniel:master
..
compare: daniel:3c3dd10fca6e35bcf863a21e982225b30b621b7f
Branches Tags
daniel:master

2 commits
a2fd004754 ... 3c3dd10fca

Author SHA1 Message Date
Daniel Kempkens
3c3dd10fca
weewx: harden systemd service 2024-07-03 21:24:35 +02:00
Daniel Kempkens
a27dd3c3dd
all: add garnix cache 2024-07-03 14:40:31 +02:00
6 changed files with 30 additions and 0 deletions
Show stats Expand all files Collapse all files

1
flake.nix
View file

@ -170,6 +170,7 @@
perSystem = { config, pkgs, inputs', ... }: {
treefmt = {
package = pkgs.treefmt1;
inherit (config.flake-root) projectRootFile;
programs = {

2
system/hosts/adsb-antenna.nix
View file

@ -31,12 +31,14 @@ in
"https://attic.cache.daniel.sx/nifoc-systems?priority=1"
"https://attic.cache.daniel.sx/nifoc-ci?priority=2"
"https://nix-community.cachix.org?priority=3"
"https://cache.garnix.io?priority=4"
];
trusted-public-keys = [
"nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
"nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
];
};

2
system/hosts/argon.nix
View file

@ -54,12 +54,14 @@ in
"https://attic.cache.daniel.sx/nifoc-systems?priority=1"
"https://attic.cache.daniel.sx/nifoc-ci?priority=2"
"https://nix-community.cachix.org?priority=3"
"https://cache.garnix.io?priority=4"
];
trusted-public-keys = [
"nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
"nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
];
trusted-users = [

2
system/hosts/mediaserver.nix
View file

@ -64,12 +64,14 @@ in
"https://attic.cache.daniel.sx/nifoc-systems?priority=1"
"https://attic.cache.daniel.sx/nifoc-ci?priority=2"
"https://nix-community.cachix.org?priority=3"
"https://cache.garnix.io?priority=4"
];
trusted-public-keys = [
"nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
"nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
];
trusted-users = [

2
system/hosts/neon.nix
View file

@ -42,12 +42,14 @@ in
"https://attic.cache.daniel.sx/nifoc-systems?priority=1"
"https://attic.cache.daniel.sx/nifoc-ci?priority=2"
"https://nix-community.cachix.org?priority=3"
"https://cache.garnix.io?priority=4"
];
trusted-public-keys = [
"nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
"nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
];
};

21
system/nixos/weewx.nix
View file

@ -41,6 +41,27 @@ in
Group = "weewx";
ExecStart = "${pkg}/bin/weewxd --config=${config.age.secrets.weewx-config.path}";
ExecStopPost = "-!${lib.getExe pkgs.umount} ${home}/weewx-data";
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
};
};