anomalos/modules/system-level/security/ at main · weegs710.tngl.sh/anomalos · Tangled

weegs710.tngl.sh / anomalos

0

A weird way of doing NixOS

0

anomalos / modules / system-level / security /

at main 1 folder 5 files

weegs710 feat(adguard): route the tailnet through adguard and advertise an exit node 3w ago

feat(adguard): route the tailnet through adguard and advertise an exit node - modules/system-level/security/adguard/adguard.nix: new. adguardhome on :53 across localhost and both tailscale addresses, ui on :3000, upstream 127.0.0.1:5300, ratelimit 0, 168h logs, a "+" ExecStartPre of tailscale wait, state into /persist - modules/system-level/security/adguard/filters.json: new. adguard dns, hagezi pro, smart-tv, urlhaus and phishtank blocklists - modules/system-level/security/dnscrypt.nix: move listen_addresses to :5300, set block_ipv6 to false - modules/system-level/net.nix: set useRoutingFeatures to server, add --advertise-exit-node to extraSetFlags - modules/user-level/nushell/config.nu: add block-s, pulling the adguard filter list into filters.json over the api

3 weeks ago

feat(adguard): route the tailnet through adguard and advertise an exit node - modules/system-level/security/adguard/adguard.nix: new. adguardhome on :53 across localhost and both tailscale addresses, ui on :3000, upstream 127.0.0.1:5300, ratelimit 0, 168h logs, a "+" ExecStartPre of tailscale wait, state into /persist - modules/system-level/security/adguard/filters.json: new. adguard dns, hagezi pro, smart-tv, urlhaus and phishtank blocklists - modules/system-level/security/dnscrypt.nix: move listen_addresses to :5300, set block_ipv6 to false - modules/system-level/net.nix: set useRoutingFeatures to server, add --advertise-exit-node to extraSetFlags - modules/user-level/nushell/config.nu: add block-s, pulling the adguard filter list into filters.json over the api

3 weeks ago

refactor(modules): hjem and nixos-modules become user-level and system-level - modules/hjem/ -> modules/user-level/ - modules/nixos-modules/ -> modules/system-level/ - lib/scripts/draw.nu: point the two bundle globs at the renamed dirs - lib/scripts/draw.nu: relabel the diagram columns user-level and system-level - lib/scripts/draw.nu: rename the hjem_ and nixos_ bindings to user_ and system_ - assets/anomalOS-diagram.svg: regenerate - assets/anomalOS-overview.svg: regenerate - modules/user-level/nushell/config.nu: repoint noct-s, zed-s and vesk-s writeback paths - modules/system-level/users.nix: repoint the bashrc comment - docs/architecture.md: rename in the gate table, the layout tree and the prose - docs/features.md: repoint module paths - docs/install.md: repoint the yubikey disable path - docs/maintenance.md: repoint the yubikey and persist paths - docs/secrets.md: repoint the secrets module path - docs/zfs.md: repoint the persist, sanoid and media-server paths - docs/jujutsu.md: repoint the jj-config and config.nu paths - LICENSE: repoint the two third-party file paths - LICENSES/README.md: repoint the two third-party file paths

1 month ago

feat(tack): give it a token solution so it stops complaining and lying - modules/system-level/core.nix: enable programs.tack with nixConfTokens and the flake pin's package, add the nix.extraOptions include for the agenix token, drop tack from systemPackages - modules/system-level/security/secrets.nix: add age.secrets.github-token at 0400 owned by the user - secrets/secrets.nix: add the github-token.age rule for both keys - secrets/github-token.age: new secret

3 weeks ago

fix(system): a stale uid stranded suricata's rules for a month and nothing said so - modules/system-level/security/suricata.nix: add a recursive Z tmpfiles rule for /var/lib/suricata, drop the size directive that was overriding frequency=daily, raise rotate from 3 to 30 - modules/system-level/security/yubikey.nix: drop GROUP="plugdev" from both udev rules and plugdev from extraGroups, uaccess already grants the seat user an ACL - modules/system-level/services.nix: force services.dbus.packages to the dbus package and system.path, add lib to the module arguments

3 weeks ago

fix(system): a stale uid stranded suricata's rules for a month and nothing said so - modules/system-level/security/suricata.nix: add a recursive Z tmpfiles rule for /var/lib/suricata, drop the size directive that was overriding frequency=daily, raise rotate from 3 to 30 - modules/system-level/security/yubikey.nix: drop GROUP="plugdev" from both udev rules and plugdev from extraGroups, uaccess already grants the seat user an ACL - modules/system-level/services.nix: force services.dbus.packages to the dbus package and system.path, add lib to the module arguments

3 weeks ago