From 49b87521de5e5456680c7dcc094ff39255e298e6 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Wed, 14 Jan 2026 13:35:04 -0600
Subject: disable some useless kernel modules

---
 modules/boot/nixos/default.nix | 50 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 42 insertions(+), 8 deletions(-)

diff --git a/modules/boot/nixos/default.nix b/modules/boot/nixos/default.nix
index 026226b..06efa15 100644
--- a/modules/boot/nixos/default.nix
+++ b/modules/boot/nixos/default.nix
@@ -26,6 +26,37 @@ in {
         efi.canTouchEfiVariables = true;
         timeout = cfg.timeout; # hold space to show boot menu
       };
+
+      # from hardened.nix
+      blacklistedKernelModules = [
+        # Obscure network protocols
+        "ax25"
+        "netrom"
+        "rose"
+
+        # Old or rare or insufficiently audited filesystems
+        "adfs"
+        "affs"
+        "bfs"
+        "befs"
+        "cramfs"
+        "efs"
+        "erofs"
+        "exofs"
+        "freevxfs"
+        "f2fs"
+        "hfs"
+        "hpfs"
+        "jfs"
+        "minix"
+        "nilfs2"
+        "ntfs"
+        "omfs"
+        "qnx4"
+        "qnx6"
+        "sysv"
+        "ufs"
+      ];
     }
     // (lib.optionalAttrs cfg.secureBoot.enable {
       lanzaboote = {
@@ -34,14 +65,17 @@ in {
       };
     });
 
-  system.etc.overlay.enable = true;
+  system.etc.overlay = {
+    enable = true;
+    mutable = true; # would love this to be false, but we're not there yet
+  };
   system.nixos-init.enable = true;
 
-  environment.systemPackages =
-    (
-      if cfg.secureBoot.enable
-      then [pkgs.sbctl]
-      else []
-    )
-    ++ [pkgs.efibootmgr];
+  # store journald logs in memory
+  services.journald.extraConfig = ''
+    Storage=volatile
+    RuntimeMaxUse=100M
+  '';
+
+  environment.systemPackages = [pkgs.efibootmgr] ++ lib.optional cfg.secureBoot.enable pkgs.sbctl;
 }
-- 
cgit v1.3.1