1 files changed, 42 insertions, 8 deletions
diff --git a/modules/boot/nixos/default.nix b/modules/boot/nixos/default.nix
index 026226b..49cca5e 100644
--- a/modules/boot/nixos/default.nix
+++ b/modules/boot/nixos/default.nix
@@ -26,6 +26,37 @@ in {
         efi.canTouchEfiVariables = true;
         timeout = cfg.timeout; # hold space to show boot menu
       };
+
+      # from hardened.nix
+      blacklistedKernelModules = [
+        # Obscure network protocols
+        "ax25"
+        "netrom"
+        "rose"
+
+        # Old or rare or insufficiently audited filesystems
+        "adfs"
+        "affs"
+        "bfs"
+        "befs"
+        "cramfs"
+        "efs"
+        # "erofs" # necessary for system.etc.overlay
+        "exofs"
+        "freevxfs"
+        "f2fs"
+        "hfs"
+        "hpfs"
+        "jfs"
+        "minix"
+        "nilfs2"
+        "ntfs"
+        "omfs"
+        "qnx4"
+        "qnx6"
+        "sysv"
+        "ufs"
+      ];
     }
     // (lib.optionalAttrs cfg.secureBoot.enable {
       lanzaboote = {
@@ -34,14 +65,17 @@ in {
       };
     });
 
-  system.etc.overlay.enable = true;
+  system.etc.overlay = {
+    enable = true;
+    mutable = true; # would love this to be false, but we're not there yet
+  };
   system.nixos-init.enable = true;
 
-  environment.systemPackages =
-    (
-      if cfg.secureBoot.enable
-      then [pkgs.sbctl]
-      else []
-    )
-    ++ [pkgs.efibootmgr];
+  # store journald logs in memory
+  services.journald.extraConfig = ''
+    Storage=volatile
+    RuntimeMaxUse=100M
+  '';
+
+  environment.systemPackages = [pkgs.efibootmgr] ++ lib.optional cfg.secureBoot.enable pkgs.sbctl;
 }