feature: data-drives on argon and boot securty (#87)

- increase security by restricting /boot to root only - add data-drives for encrypted drives that will get mounted through crypttab rather than the initrd Reviewed-on: #87 Co-authored-by: aaron <aaron@0x29a.ch>
2026-10-03 10:57:34 +02:00
parent b42b873eb1
commit 450559f8c6
7 changed files with 54 additions and 36 deletions
@@ -75,7 +75,7 @@ fileSystems."/" =
 fileSystems."/boot" =
  { device = "/dev/disk/by-label/nixboot";
    fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
+    options = [ "fmask=0077" "dmask=0077" ];  # only root may read /boot
  };
 fileSystems."/home" =
  { device = "/dev/disk/by-label/nixhome";