boot: use hardened linux 6.6 LTS kernel

flake.lock

@@ -524,11 +524,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1718572539,
-        "narHash": "sha256-sVckVlLB7jabSssRztrY+MGewz1GZF4jbbk6sMFHseU=",
+        "lastModified": 1719756072,
+        "narHash": "sha256-jMmXf9bNhsta1nZcRGwUU6/ItCs+YMXPeffRbVEHLX4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "10f11abbd11e1f659e39893a4b69dcc84767433f",
+        "rev": "3c7eedd1d7dba25f9302b5362a9efdf6e74b66ff",
         "type": "github"
       },
       "original": {
@@ -540,11 +540,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1718318537,
-        "narHash": "sha256-4Zu0RYRcAY/VWuu6awwq4opuiD//ahpc2aFHg2CWqFY=",
+        "lastModified": 1719506693,
+        "narHash": "sha256-C8e9S7RzshSdHB7L+v9I51af1gDM5unhJ2xO1ywxNH8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e9ee548d90ff586a6471b4ae80ae9cfcbceb3420",
+        "rev": "b2852eb9365c6de48ffb0dc2c9562591f652242a",
         "type": "github"
       },
       "original": {
@@ -588,11 +588,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1718437845,
-        "narHash": "sha256-ZT7Oc1g4I4pHVGGjQFnewFVDRLH5cIZhEzODLz9YXeY=",
+        "lastModified": 1719426051,
+        "narHash": "sha256-yJL9VYQhaRM7xs0M867ZFxwaONB9T2Q4LnGo1WovuR4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "752c634c09ceb50c45e751f8791cb45cb3d46c9e",
+        "rev": "89c49874fb15f4124bf71ca5f42a04f2ee5825fd",
         "type": "github"
       },
       "original": {

hosts/frikandel/configuration.nix

@@ -19,6 +19,7 @@ in {
     # Hack so that network is considered up by boot.initrd.network and postCommands gets executed.
     "ip=127.0.0.1:::::lo:none"
   ];
+
   boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_net" ];
   boot.initrd.network = {
     enable = true;

hosts/pie/configuration.nix

@@ -21,7 +21,6 @@ in {
   boot.loader.generic-extlinux-compatible.enable = false;
 
   boot.supportedFilesystems = [ "zfs" ];
-  boot.kernelPackages = pkgs.linuxPackages_6_1_hardened;
 
   boot.kernelParams = [
     "boot.shell_on_fail=1"

modules/core/boot.nix

@@ -12,7 +12,7 @@ in {
       loader.systemd-boot.enable = lib.mkDefault true;
 
       # Use latest LTS linux kernel by default
-      kernelPackages = lib.mkDefault pkgs.linuxPackages_6_6_hardened;
+      kernelPackages = pkgs.linuxPackages_6_6_hardened;
 
       # Support ntfs drives
       supportedFilesystems = ["ntfs"];

modules/printing/default.nix

@@ -21,4 +21,10 @@
   ] ++ (if (pkgs.system == "x86_64-linux")
   then [ pkgs.cups-brother-hl3140cw ]
   else []);
+
+  environment.persistence."/persist" = {
+    directories = [
+      "/etc/lib/cups"
+    ];
+  };
 }

modules/wireguard/ehex.nix

@@ -46,8 +46,6 @@ in {
             allowedIPs = [ "10.42.0.0/22" "10.0.66.0/24" ];
             persistentKeepalive = 15;
             dynamicEndpointRefreshSeconds = 30;
-# DNS = 10.0.66.10, ehex.cloud,ehex.de
-# DNS = 10.0.66.12, ehex.cloud,ehex.de
           }
         ];
       };