core/networking: harden all the things

flake.lock

@@ -423,11 +423,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1711485334,
+        "lastModified": 1711717242,
-        "narHash": "sha256-qOHrFSfo6W5J5RkkJy7xLSECKaK/NITQXfeh715fD7s=",
+        "narHash": "sha256-PW9J9sFw5DA4Fo3Cq4Soc+an6tjTS4VV2NxG6G0UMqw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e19e9bceda53148e8dd6e8f54bf19375e5e60af9",
+        "rev": "824952ff6b32b0019465b139b5c76d915ec074ea",
         "type": "github"
       },
       "original": {
@@ -439,11 +439,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1711333969,
+        "lastModified": 1711523803,
-        "narHash": "sha256-5PiWGn10DQjMZee5NXzeA6ccsv60iLu+Xtw+mfvkUAs=",
+        "narHash": "sha256-UKcYiHWHQynzj6CN/vTcix4yd1eCu1uFdsuarupdCQQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "57e6b3a9e4ebec5aa121188301f04a6b8c354c9b",
+        "rev": "2726f127c15a4cc9810843b96cad73c7eb39e443",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1711124224,
+        "lastModified": 1711460390,
-        "narHash": "sha256-l0zlN/3CiodvWDtfBOVxeTwYSRz93muVbXWSpaMjXxM=",
+        "narHash": "sha256-akSgjDZL6pVHEfSE6sz1DNSXuYX6hq+P/1Z5IoYWs7E=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "56528ee42526794d413d6f244648aaee4a7b56c0",
+        "rev": "44733514b72e732bd49f5511bd0203dea9b9a434",
         "type": "github"
       },
       "original": {

hosts/droppie/networking.nix

@@ -15,7 +15,6 @@
 
   # Allow pub.solar restic backups
   services.openssh.allowSFTP = true;
-  services.openssh.openFirewall = true;
 
   age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-droppie.age";
 

hosts/frikandel/configuration.nix

@@ -44,7 +44,6 @@ in {
   };
 
   boot.supportedFilesystems = [ "zfs" ];
-  boot.kernelPackages = pkgs.linuxPackages_6_1;
 
   # Copy the NixOS configuration file and link it from the resulting system
   # (/run/current-system/configuration.nix). This is useful in case you

hosts/frikandel/networking.nix

@@ -14,8 +14,6 @@
     "2a0f:fc81::" #dns0.eu
   ];
 
-  services.openssh.openFirewall = true;
-
   # Network configuration (Hetzner uses static IP assignments, and we don't use DHCP here)
   networking.useDHCP = false;
   networking.interfaces.enp1s0 = {

hosts/pie/configuration.nix

@@ -21,7 +21,7 @@ in {
   boot.loader.generic-extlinux-compatible.enable = false;
 
   boot.supportedFilesystems = [ "zfs" ];
-  boot.kernelPackages = pkgs.linuxPackages_6_1;
+  boot.kernelPackages = pkgs.linuxPackages_6_1_hardened;
 
   boot.kernelParams = [
     "boot.shell_on_fail=1"

hosts/pie/networking.nix

@@ -27,7 +27,6 @@
     "192.168.178.3" = [ "droppie-initrd.b12f.io" ];
   };
 
-  services.openssh.openFirewall = true;
   services.openssh.allowSFTP = true;
 
   age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-pie.age";

modules/core/boot.nix

@@ -12,7 +12,7 @@ in {
       loader.systemd-boot.enable = lib.mkDefault true;
 
       # Use latest LTS linux kernel by default
-      kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
+      kernelPackages = lib.mkDefault pkgs.linuxPackages_6_7_hardened;
 
       # Support ntfs drives
       supportedFilesystems = ["ntfs"];

modules/core/default.nix

@@ -13,26 +13,9 @@ in {
     ./i18n.nix
     ./networking.nix
     ./packages.nix
+    ./hardening.nix
   ];
 
   # Service that makes Out of Memory Killer more effective
   services.earlyoom.enable = true;
-
-  services.logind.lidSwitch = "hibernate";
-
-  services.tor.settings = {
-    UseBridges = true;
-  };
-
-  # The options below are directly taken from or inspired by
-  # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
-
-  # Limit the use of sudo to the group wheel
-  security.sudo.execWheelOnly = true;
-
-  # Remove the complete default environment of packages like
-  # nano, perl and rsync
-  environment.defaultPackages = lib.mkForce [];
-
-  # fileSystems."/".options = [ "noexec" ];
 }

modules/core/hardening.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.pub-solar.core;
+  psCfg = config.pub-solar;
+in {
+  services.tor.settings = {
+    UseBridges = true;
+  };
+
+  # Always go to encrypted hibernation instead of sleep
+  services.logind.lidSwitch = "hibernate";
+
+  # The options below are directly taken from or inspired by
+  # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
+
+  # Limit the use of sudo to the group wheel
+  security.sudo.execWheelOnly = true;
+
+  # Remove the complete default environment of packages like
+  # nano, perl and rsync
+  environment.defaultPackages = lib.mkForce [];
+
+  # fileSystems."/".options = [ "noexec" ];
+
+  # disable coredump that could be exploited later
+  # and also slow down the system when something crash
+  systemd.coredump.enable = false;
+
+  # required to run chromium
+  security.chromiumSuidSandbox.enable = true;
+
+  # enable firejail
+  programs.firejail.enable = true;
+
+  # create system-wide executables firefox and chromium
+  # that will wrap the real binaries so everything
+  # work out of the box.
+  programs.firejail.wrappedBinaries = {
+    firefox = {
+      executable = "${pkgs.lib.getBin pkgs.firefox}/bin/firefox";
+      profile = "${pkgs.firejail}/etc/firejail/firefox.profile";
+    };
+    ungoogled-chromium = {
+      executable = "${pkgs.lib.getBin pkgs.ungoogled-chromium}/bin/chromium";
+      profile = "${pkgs.firejail}/etc/firejail/chromium.profile";
+    };
+  };
+
+  # enable antivirus clamav and
+  # keep the signatures' database updated
+  services.clamav.daemon.enable = true;
+  services.clamav.updater.enable = true;
+}

modules/core/networking.nix

@@ -37,6 +37,9 @@
     '';
   };
 
+  # Don't expose SSH via public interfaces
+  networking.firewall.interfaces.wg-private.allowedTCPPorts = [ 22 ];
+
   # For rage encryption, all hosts need a ssh key pair
   services.openssh = {
     enable = true;

modules/persistence/default.nix

@@ -8,6 +8,7 @@
       "/var/lib/nixos"
       "/var/lib/systemd/coredump"
       "/etc/NetworkManager/system-connections"
+      "/etc/firejail"
     ];
 
     files = [