kenji
6eef6108c4
- Remove SSH service (was temporary) - Close unused firewall ports (22, 80, 53) - Require sudo password for wheel group - Disable systemd-boot editor to prevent boot tampering - Remove boot.shell_on_fail kernel parameter - Add kernel hardening parameters (slab_nomerge, init_on_alloc, etc.) - Add sysctl hardening (dmesg_restrict, kptr_restrict, etc.) - Disable Avahi firewall broadcast - Disable Bluetooth auto power-on at boot 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
31 lines
577 B
Nix
31 lines
577 B
Nix
{pkgs, ...}: {
|
|
boot = {
|
|
consoleLogLevel = 3;
|
|
initrd.verbose = false;
|
|
loader = {
|
|
timeout = 0;
|
|
systemd-boot = {
|
|
enable = true;
|
|
editor = false;
|
|
};
|
|
|
|
efi = {
|
|
canTouchEfiVariables = true;
|
|
efiSysMountPoint = "/boot";
|
|
};
|
|
};
|
|
initrd = {
|
|
systemd.enable = true;
|
|
};
|
|
plymouth = {
|
|
enable = true;
|
|
# themePackages = [
|
|
# (pkgs.adi1090x-plymouth-themes.override {
|
|
# selected_themes = ["circle_hud"];
|
|
# })
|
|
# ];
|
|
# theme = "circle_hud";
|
|
};
|
|
};
|
|
}
|