rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden deployment, authentication, firewall and media storage failure paths

Browse source
This commit is contained in:
rope 2026-09-14 11:50:22 +01:00
parent 64ede7bd05
commit 7145a35927
35 changed files with 2529 additions and 499 deletions
Download patch file Download diff file Expand all files Collapse all files

12
common.nix
View file

@ -61,7 +61,9 @@ let
post = "nvd diff $OLD_SYSTEM /run/current-system && (command -v record-update &>/dev/null && record-update $OLD_SYSTEM /run/current-system || true)";
# The server evaluates and builds for itself.
localUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && sudo nixos-rebuild switch $@ --refresh --flake ${flake} -L${buildLog} && ${post}' --";
localUpdate = if config.networking.hostName == "FredOS-Mediaserver"
then "sudo fred-deploy"
else "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && sudo nixos-rebuild switch $@ --refresh --flake ${flake} -L${buildLog} && ${post}' --";
# The clients offload the *evaluation* too, not just the build. nixos-rebuild
# always evaluates on the machine it runs on (--build-host ships the
@ -81,6 +83,7 @@ in
# Generic settings #
./settings/desktop.nix
./settings/auth.nix
./settings/hyprland.nix
./settings/quickshell.nix
./settings/theming.nix
@ -125,6 +128,7 @@ in
./services/redlib.nix
./services/hardware-health.nix
./services/wan-watchdog.nix
./services/deployment.nix
./services/valheim-autoupdate.nix
./services/owncast.nix
./services/prebuild.nix
@ -152,10 +156,8 @@ in
boot.loader.timeout = lib.mkDefault 5;
systemd.services.NetworkManager-wait-online.enable = false;
systemd.services.systemd-udev-settle.enable = false;
systemd.services.firewall = {
wantedBy = lib.mkForce [ ];
after = [ "multi-user.target" ];
};
# Keep NixOS's early firewall startup. The router disables this firewall
# explicitly in services/router.nix and owns its nftables rules separately.
boot.initrd.verbose = false;
#############################################################################