blob: 06efa150c0f01225ad6029726b2fc7d77ab8b0e7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
{
pkgs,
config,
lib,
...
}: let
cfg = config.collinux.boot;
in {
imports = [
./plymouth.nix
];
boot =
{
bcache.enable = false; # why is this default on? I DON'T CARE ABOUT bcache
initrd = {
verbose = false;
systemd.enable = true;
checkJournalingFS = false;
};
loader = {
systemd-boot = lib.optionalAttrs (cfg.systemd-boot.enable && !cfg.secureBoot.enable) {
enable = true;
configurationLimit = 3;
};
efi.canTouchEfiVariables = true;
timeout = cfg.timeout; # hold space to show boot menu
};
# from hardened.nix
blacklistedKernelModules = [
# Obscure network protocols
"ax25"
"netrom"
"rose"
# Old or rare or insufficiently audited filesystems
"adfs"
"affs"
"bfs"
"befs"
"cramfs"
"efs"
"erofs"
"exofs"
"freevxfs"
"f2fs"
"hfs"
"hpfs"
"jfs"
"minix"
"nilfs2"
"ntfs"
"omfs"
"qnx4"
"qnx6"
"sysv"
"ufs"
];
}
// (lib.optionalAttrs cfg.secureBoot.enable {
lanzaboote = {
enable = true;
pkiBundle = "/var/lib/sbctl";
};
});
system.etc.overlay = {
enable = true;
mutable = true; # would love this to be false, but we're not there yet
};
system.nixos-init.enable = true;
# store journald logs in memory
services.journald.extraConfig = ''
Storage=volatile
RuntimeMaxUse=100M
'';
environment.systemPackages = [pkgs.efibootmgr] ++ lib.optional cfg.secureBoot.enable pkgs.sbctl;
}
|
