From 450559f8c6b050f9cc38ebef06721e151dabab69 Mon Sep 17 00:00:00 2001 From: aaron Date: Sat, 3 Oct 2026 10:57:34 +0200 Subject: [PATCH 1/2] feature: data-drives on argon and boot securty (#87) - increase security by restricting /boot to root only - add data-drives for encrypted drives that will get mounted through crypttab rather than the initrd Reviewed-on: https://git.0x29a.ch/aaron/nixconfig/pulls/87 Co-authored-by: aaron --- INSTALLATION.md | 2 +- hosts/argon/configuration.nix | 35 +++++----------------- hosts/argon/hardware-configuration.nix | 4 +-- hosts/default/hardware-configuration.nix | 4 +-- hosts/krypton/hardware-configuration.nix | 4 +-- hosts/neon/hardware-configuration.nix | 4 +-- modules/nixos/data-drives.nix | 37 ++++++++++++++++++++++++ 7 files changed, 54 insertions(+), 36 deletions(-) create mode 100644 modules/nixos/data-drives.nix diff --git a/INSTALLATION.md b/INSTALLATION.md index a8f132d..56d205c 100644 --- a/INSTALLATION.md +++ b/INSTALLATION.md @@ -75,7 +75,7 @@ fileSystems."/" = fileSystems."/boot" = { device = "/dev/disk/by-label/nixboot"; fsType = "vfat"; - options = [ "fmask=0022" "dmask=0022" ]; + options = [ "fmask=0077" "dmask=0077" ]; # only root may read /boot }; fileSystems."/home" = { device = "/dev/disk/by-label/nixhome"; diff --git a/hosts/argon/configuration.nix b/hosts/argon/configuration.nix index d67967b..7159fd6 100644 --- a/hosts/argon/configuration.nix +++ b/hosts/argon/configuration.nix @@ -1,17 +1,7 @@ # argon: desktop with an amd gpu and three luks-encrypted data drives. -# The drives are unlocked in the initrd with keyfiles from /etc/nixos/keys. -{ lib, pkgs, ... }: +{ pkgs, ... }: -let - # luks name -> partition uuid, mounted at /mnt/ - drives = { - data1 = "dfae62cc-bad1-4879-bf9a-461bde833625"; - data2 = "8312edae-9247-481b-a313-52a7f848f027"; - nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8"; - }; - key = name: "/etc/nixos/keys/${name}.key"; -in { imports = [ ../../modules/nixos/appimage.nix @@ -19,6 +9,7 @@ in ../../modules/nixos/audio.nix ../../modules/nixos/bootloader.nix ../../modules/nixos/certificates.nix + ../../modules/nixos/data-drives.nix ../../modules/nixos/gnupg.nix ../../modules/nixos/greetd.nix ../../modules/nixos/locales.nix @@ -46,22 +37,12 @@ in }; hardware.amdgpu.initrd.enable = true; - # encrypted data drives - boot.initrd.secrets = lib.mapAttrs' (name: _: lib.nameValuePair (key name) (key name)) drives; - boot.initrd.luks.devices = lib.mapAttrs (name: uuid: { - device = "/dev/disk/by-uuid/${uuid}"; - keyFile = key name; - # trim for ssds, ignored by drives without discard support - allowDiscards = true; - }) drives; - fileSystems = lib.mapAttrs' ( - name: _: - lib.nameValuePair "/mnt/${name}" { - device = "/dev/mapper/${name}"; - fsType = "ext4"; - options = [ "nofail" ]; - } - ) drives; + # encrypted data drives, see data-drives.nix + local.dataDrives = { + data1 = "dfae62cc-bad1-4879-bf9a-461bde833625"; + data2 = "8312edae-9247-481b-a313-52a7f848f027"; + nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8"; + }; environment.systemPackages = with pkgs; [ amdgpu_top diff --git a/hosts/argon/hardware-configuration.nix b/hosts/argon/hardware-configuration.nix index 69686bf..4518826 100644 --- a/hosts/argon/hardware-configuration.nix +++ b/hosts/argon/hardware-configuration.nix @@ -39,8 +39,8 @@ device = "/dev/disk/by-label/nixboot"; fsType = "vfat"; options = [ - "fmask=0022" - "dmask=0022" + "fmask=0077" + "dmask=0077" ]; }; diff --git a/hosts/default/hardware-configuration.nix b/hosts/default/hardware-configuration.nix index 42645ca..f872938 100644 --- a/hosts/default/hardware-configuration.nix +++ b/hosts/default/hardware-configuration.nix @@ -40,8 +40,8 @@ device = "/dev/disk/by-label/nixboot"; fsType = "vfat"; options = [ - "fmask=0022" - "dmask=0022" + "fmask=0077" + "dmask=0077" ]; }; fileSystems."/home" = { diff --git a/hosts/krypton/hardware-configuration.nix b/hosts/krypton/hardware-configuration.nix index 10b7825..c0cbae7 100644 --- a/hosts/krypton/hardware-configuration.nix +++ b/hosts/krypton/hardware-configuration.nix @@ -40,8 +40,8 @@ device = "/dev/disk/by-label/nixboot"; fsType = "vfat"; options = [ - "fmask=0022" - "dmask=0022" + "fmask=0077" + "dmask=0077" ]; }; diff --git a/hosts/neon/hardware-configuration.nix b/hosts/neon/hardware-configuration.nix index e115731..6986b76 100644 --- a/hosts/neon/hardware-configuration.nix +++ b/hosts/neon/hardware-configuration.nix @@ -43,8 +43,8 @@ device = "/dev/disk/by-label/nixboot"; fsType = "vfat"; options = [ - "fmask=0022" - "dmask=0022" + "fmask=0077" + "dmask=0077" ]; }; diff --git a/modules/nixos/data-drives.nix b/modules/nixos/data-drives.nix new file mode 100644 index 0000000..6b5dfd5 --- /dev/null +++ b/modules/nixos/data-drives.nix @@ -0,0 +1,37 @@ +# luks-encrypted data drives, unlocked after boot via /etc/crypttab with +# keyfiles from /etc/nixos/keys/.key on the encrypted root. +# Not in boot.initrd.luks on purpose: keyfiles there end up in the initrd +# on the unencrypted /boot. + +{ config, lib, ... }: + +let + drives = config.local.dataDrives; +in +{ + options.local.dataDrives = lib.mkOption { + type = lib.types.attrsOf lib.types.str; + default = { }; + example = { + data1 = "dfae62cc-bad1-4879-bf9a-461bde833625"; + }; + description = "luks name -> luks partition uuid, mounted at /mnt/"; + }; + + config = lib.mkIf (drives != { }) { + environment.etc.crypttab.text = lib.concatStrings ( + lib.mapAttrsToList ( + name: uuid: "${name} /dev/disk/by-uuid/${uuid} /etc/nixos/keys/${name}.key luks,discard,nofail\n" + ) drives + ); + + fileSystems = lib.mapAttrs' ( + name: _: + lib.nameValuePair "/mnt/${name}" { + device = "/dev/mapper/${name}"; + fsType = "ext4"; + options = [ "nofail" ]; + } + ) drives; + }; +} From 66a19890bd22146f8d7453d155ba16e38cd5744d Mon Sep 17 00:00:00 2001 From: aaron Date: Sat, 3 Oct 2026 11:37:40 +0200 Subject: [PATCH 2/2] chore: remove old vm host entry since it is not used anymore (#89) Reviewed-on: https://git.0x29a.ch/aaron/nixconfig/pulls/89 Co-authored-by: aaron --- README.md | 2 +- flake.nix | 1 - hosts/default/configuration.nix | 139 ----------------------- hosts/default/hardware-configuration.nix | 60 ---------- hosts/default/home.nix | 79 ------------- 5 files changed, 1 insertion(+), 280 deletions(-) delete mode 100644 hosts/default/configuration.nix delete mode 100644 hosts/default/hardware-configuration.nix delete mode 100644 hosts/default/home.nix diff --git a/README.md b/README.md index cb1307c..588058c 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ My personal NixOS configurations. ├── hosts │ ├── argon # desktop │ ├── neon # laptop -│ └── default # test vm +│ └── krypton # second laptop │ ├── configuration.nix # host-specific settings and module imports │ ├── hardware-configuration.nix # generated by nixos-generate-config │ └── niri.nix # host-specific niri settings (outputs, input) diff --git a/flake.nix b/flake.nix index 84bc252..4999dff 100644 --- a/flake.nix +++ b/flake.nix @@ -53,7 +53,6 @@ in { nixosConfigurations = { - default = mkHost "default"; neon = mkHost "neon"; argon = mkHost "argon"; krypton = mkHost "krypton"; diff --git a/hosts/default/configuration.nix b/hosts/default/configuration.nix deleted file mode 100644 index b0bf438..0000000 --- a/hosts/default/configuration.nix +++ /dev/null @@ -1,139 +0,0 @@ -# 0x29a nixos config - -{ pkgs, ... }: - -{ - # use flakes - nix.settings.experimental-features = [ - "nix-command" - "flakes" - ]; - - # configure bootloader - boot.loader.systemd-boot.enable = false; - boot.loader.grub = { - enable = true; - device = "nodev"; - efiSupport = true; - }; - boot.loader.efi.canTouchEfiVariables = true; - boot.kernelParams = [ - "quiet" - "console.ttyS0,115200n8" # allow terminals on serial console - ]; - # plymouth boot eye candy - boot.initrd.systemd.enable = true; - boot.plymouth.enable = true; - boot.plymouth.theme = "spinner"; - # use latest kernel - boot.kernelPackages = pkgs.linuxPackages_latest; - - # guest agent for proxmox - services.qemuGuest.enable = true; - - # networking - networking.hostName = "nixos"; - networking.networkmanager.enable = true; - - # time zone. - time.timeZone = "Europe/Amsterdam"; - # select internationalisation properties - i18n.defaultLocale = "en_US.UTF-8"; - i18n.extraLocaleSettings = { - LC_ADDRESS = "en_US.UTF-8"; - LC_IDENTIFICATION = "en_US.UTF-8"; - LC_MEASUREMENT = "en_US.UTF-8"; - LC_MONETARY = "en_US.UTF-8"; - LC_NAME = "en_US.UTF-8"; - LC_NUMERIC = "en_US.UTF-8"; - LC_PAPER = "en_US.UTF-8"; - LC_TELEPHONE = "en_US.UTF-8"; - LC_TIME = "en_US.UTF-8"; - }; - console = { - font = "Lat2-Terminus16"; - keyMap = "de_CH-latin1"; - }; - - # window manager configs - services.xserver = { - enable = true; - xkb.layout = "ch"; - xkb.options = "eurosign:e,caps:escape"; - - windowManager.qtile = { - enable = true; - extraPackages = - python3Packages: with python3Packages; [ - qtile-extras - ]; - }; - }; - - environment.pathsToLink = [ "/libexec" ]; - environment.variables.EDITOR = "vim"; - - # enable sound - services.pipewire = { - enable = true; - pulse.enable = true; - }; - - # define a user account - users.users.aaron = { - isNormalUser = true; - group = "users"; - extraGroups = [ "wheel" ]; - shell = pkgs.zsh; - packages = with pkgs; [ - tree - fastfetch - ]; - }; - - # browser - programs.firefox.enable = true; - - # zsh config - programs.zsh = { - enable = true; - enableCompletion = true; - autosuggestions.enable = true; - ohMyZsh = { - enable = true; - plugins = [ - "git" - "sudo" - ]; - theme = "agnoster"; - }; - }; - - # system packages - environment.systemPackages = with pkgs; [ - vim - neovim - git - ghostty - kitty - wget - gnupg - ]; - - # Some programs need SUID wrappers - programs.mtr.enable = true; - programs.gnupg.agent = { - enable = true; - enableSSHSupport = true; - }; - - # enable the OpenSSH daemon - services.openssh.enable = true; - - # firewall configs - networking.firewall.allowedTCPPorts = [ 22 ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - - # install state version - system.stateVersion = "25.05"; # Don't change -} diff --git a/hosts/default/hardware-configuration.nix b/hosts/default/hardware-configuration.nix deleted file mode 100644 index f872938..0000000 --- a/hosts/default/hardware-configuration.nix +++ /dev/null @@ -1,60 +0,0 @@ -# 0x29a nixos hardware configuration - -{ - config, - lib, - pkgs, - modulesPath, - ... -}: - -{ - imports = [ - (modulesPath + "/profiles/qemu-guest.nix") - ]; - - # boot and initrd configs - boot.initrd.availableKernelModules = [ - "uhci_hcd" - "ehci_pci" - "ahci" - "virtio_pci" - "virtio_scsi" - "sd_mod" - "sr_mod" - ]; - boot.initrd.kernelModules = [ - "dm-snapshot" - "cryptd" - ]; - boot.kernelModules = [ ]; - boot.extraModulePackages = [ ]; - boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt"; - - # file systems - fileSystems."/" = { - device = "/dev/disk/by-label/nixroot"; - fsType = "ext4"; - }; - fileSystems."/boot" = { - device = "/dev/disk/by-label/nixboot"; - fsType = "vfat"; - options = [ - "fmask=0077" - "dmask=0077" - ]; - }; - fileSystems."/home" = { - device = "/dev/disk/by-label/nixhome"; - fsType = "ext4"; - }; - swapDevices = [ - { device = "/dev/disk/by-label/nixswap"; } - ]; - - # enable dhcp on all interfaces - networking.useDHCP = lib.mkDefault true; - - # set host arch - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; -} diff --git a/hosts/default/home.nix b/hosts/default/home.nix deleted file mode 100644 index 9ebc116..0000000 --- a/hosts/default/home.nix +++ /dev/null @@ -1,79 +0,0 @@ -{ pkgs, ... }: - -{ - # user config - home.username = "aaron"; - home.homeDirectory = "/home/aaron"; - - # packages - home.packages = with pkgs; [ - fastfetch - zip - xz - unzip - p7zip - jq - mtr - iperf3 - dnsutils - ldns - socat - nmap - cowsay - file - which - tree - zstd - gnupg - btop - iotop - iftop - strace - lsof - sysstat - lm_sensors - ethtool - pciutils - usbutils - ]; - - # configure git - programs.git.settings = { - enable = true; - userName = "aaron"; - userEmail = "aaron@0x29a.ch"; - }; - - programs.zsh = { - enable = true; - autosuggestion.enable = true; - syntaxHighlighting.enable = true; - oh-my-zsh = { - enable = true; - plugins = [ - "git" - "sudo" - "python" - "ansible" - ]; - theme = "agnoster"; - }; - }; - - ## deploy qtile config - #home.file."qtile-config" = { - # target = ".config/qtile/config.py"; - # source = "${inputs.qtile-config}/qtile_config/config.py"; - # force = true; - #}; - - home.sessionVariables = { - EDITOR = "vim"; - }; - - # enable home manager - programs.home-manager.enable = true; - - # don't change - home.stateVersion = "25.05"; -}