diff options
Diffstat (limited to 'modules/boot')
| -rw-r--r-- | modules/boot/nixos/default.nix | 50 | ||||
| -rw-r--r-- | modules/boot/options.nix | 9 |
2 files changed, 46 insertions, 13 deletions
diff --git a/modules/boot/nixos/default.nix b/modules/boot/nixos/default.nix index 026226b..49cca5e 100644 --- a/modules/boot/nixos/default.nix +++ b/modules/boot/nixos/default.nix @@ -26,6 +26,37 @@ in { efi.canTouchEfiVariables = true; timeout = cfg.timeout; # hold space to show boot menu }; + + # from hardened.nix + blacklistedKernelModules = [ + # Obscure network protocols + "ax25" + "netrom" + "rose" + + # Old or rare or insufficiently audited filesystems + "adfs" + "affs" + "bfs" + "befs" + "cramfs" + "efs" + # "erofs" # necessary for system.etc.overlay + "exofs" + "freevxfs" + "f2fs" + "hfs" + "hpfs" + "jfs" + "minix" + "nilfs2" + "ntfs" + "omfs" + "qnx4" + "qnx6" + "sysv" + "ufs" + ]; } // (lib.optionalAttrs cfg.secureBoot.enable { lanzaboote = { @@ -34,14 +65,17 @@ in { }; }); - system.etc.overlay.enable = true; + system.etc.overlay = { + enable = true; + mutable = true; # would love this to be false, but we're not there yet + }; system.nixos-init.enable = true; - environment.systemPackages = - ( - if cfg.secureBoot.enable - then [pkgs.sbctl] - else [] - ) - ++ [pkgs.efibootmgr]; + # store journald logs in memory + services.journald.extraConfig = '' + Storage=volatile + RuntimeMaxUse=100M + ''; + + environment.systemPackages = [pkgs.efibootmgr] ++ lib.optional cfg.secureBoot.enable pkgs.sbctl; } diff --git a/modules/boot/options.nix b/modules/boot/options.nix index 2f670f9..9e85570 100644 --- a/modules/boot/options.nix +++ b/modules/boot/options.nix @@ -1,9 +1,11 @@ { + my-lib, config, lib, ... }: let - inherit (lib) mkOption mkEnableOption types; + inherit (lib) mkOption mkEnableOption; + inherit (my-lib.options {inherit lib config;}) mkThemeOption; in { options = { collinux.boot = { @@ -15,10 +17,7 @@ in { }; plymouth = { enable = mkEnableOption "plymouth bootsplash"; - theme = mkOption { - type = types.enum ["catppuccin" "adwaita"]; - default = config.collinux.theme; - }; + theme = mkThemeOption "plymouth"; }; secureBoot.enable = mkEnableOption "lanzaboote"; }; |