Kabbone/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

some minor security improvements found by claude

Browse Source
This commit is contained in:
Kabbone
2026-04-26 10:01:18 +02:00
parent 447fc61c0b
commit c5e5b84bfb
4 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
modules/hardware/remoteBuilder.nix
View File

@@ -2,16 +2,17 @@
{ {
users.users.nixremote = { # System User users.users.nixremote = { # System User
isNormalUser = true; isSystemUser = true;
group = "nixremote";
extraGroups = [ "kvm" ]; extraGroups = [ "kvm" ];
shell = pkgs.zsh; # Default shell
uid = 1001; uid = 1001;
# initialPassword = "password95";
openssh.authorizedKeys.keys = [ openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILczsj4W1kFQaalFwaY+RJ4LEzNeFKD+itXB40Q2O59M nixremote@hades" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILczsj4W1kFQaalFwaY+RJ4LEzNeFKD+itXB40Q2O59M nixremote@hades"
]; ];
}; };
users.groups.nixremote = {};
nix.settings.trusted-users = [ nix.settings.trusted-users = [
"nixremote" "nixremote"
]; ];

3
modules/services/server/coturn.nix
View File

@@ -4,7 +4,6 @@
enable = true; enable = true;
no-cli = true; no-cli = true;
no-tcp-relay = true; no-tcp-relay = true;
no-tls = true;
min-port = 49000; min-port = 49000;
max-port = 50000; max-port = 50000;
use-auth-secret = true; use-auth-secret = true;
@@ -53,7 +52,7 @@
allowedUDPPortRanges = range; allowedUDPPortRanges = range;
allowedUDPPorts = [ 3478 ]; allowedUDPPorts = [ 3478 ];
allowedTCPPortRanges = range; allowedTCPPortRanges = range;
allowedTCPPorts = [ 3478 ]; allowedTCPPorts = [ 3478 5349 ];
}; };
}; };
# get a certificate # get a certificate

2
modules/services/server/gitea.nix
View File

@@ -29,7 +29,7 @@
LFS_ALLOW_PURE_SSH = true; LFS_ALLOW_PURE_SSH = true;
}; };
security = { security = {
MIN_PASSWORD_LENGTH = 8; MIN_PASSWORD_LENGTH = 12;
PASSWORD_CHECK_PWN = true; PASSWORD_CHECK_PWN = true;
PASSWORD_HASH_ALGO = "argon2"; PASSWORD_HASH_ALGO = "argon2";
}; };

4
modules/services/server/nextcloud.nix
View File

@@ -1,10 +1,6 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
environment.systemPackages = with pkgs; [ # Default packages install system-wide
appimage-run
];
services.nextcloud = { services.nextcloud = {
enable = true; enable = true;
hostName = "cloud.kabtop.de"; hostName = "cloud.kabtop.de";