add profiles for security, firewalls, and users

7 files changed, 24 insertions, 15 deletions

diff --git a/machines/nixos/x86_64-linux/do-rproxy/default.nix b/machines/nixos/x86_64-linux/do-rproxy/default.nix
index 7888843..f3906a1 100644
--- a/machines/nixos/x86_64-linux/do-rproxy/default.nix
+++ b/machines/nixos/x86_64-linux/do-rproxy/default.nix
@@ -27,9 +27,12 @@
     "${self}/profiles/core/locale.nix"
     "${self}/profiles/core/ssh.nix"
     "${self}/profiles/core/tools.nix"
+    "${self}/profiles/core/security.nix"
+    "${self}/profiles/core/users.nix"
     "${self}/profiles/core/motd.nix"
     "${self}/profiles/nix/gc.nix"
     "${self}/profiles/network/networkd.nix"
+    "${self}/profiles/network/firewall.nix"
     "${self}/profiles/services/podman.nix"
   ];
 
diff --git a/machines/nixos/x86_64-linux/synology-vm/default.nix b/machines/nixos/x86_64-linux/synology-vm/default.nix
index 820f1a7..a7d0aa1 100644
--- a/machines/nixos/x86_64-linux/synology-vm/default.nix
+++ b/machines/nixos/x86_64-linux/synology-vm/default.nix
@@ -41,9 +41,12 @@
     "${self}/profiles/core/locale.nix"
     "${self}/profiles/core/ssh.nix"
     "${self}/profiles/core/tools.nix"
+    "${self}/profiles/core/security.nix"
+    "${self}/profiles/core/users.nix"
     "${self}/profiles/core/motd.nix"
     "${self}/profiles/nix/gc.nix"
     "${self}/profiles/network/networkd.nix"
+    "${self}/profiles/network/firewall.nix"
     "${self}/profiles/services/podman.nix"
   ];
 
diff --git a/profiles/core/security.nix b/profiles/core/security.nix
new file mode 100644
index 0000000..146012f
--- /dev/null
+++ b/profiles/core/security.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  security.sudo.wheelNeedsPassword = false;
+}
diff --git a/profiles/core/users.nix b/profiles/core/users.nix
new file mode 100644
index 0000000..e0d8662
--- /dev/null
+++ b/profiles/core/users.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  users.mutableUsers = false;
+}
diff --git a/profiles/default.nix b/profiles/default.nix
index 48da7b4..6d0af84 100644
--- a/profiles/default.nix
+++ b/profiles/default.nix
@@ -25,11 +25,7 @@
     };
   };
 
-  ## only allow declarative user management
-  users.mutableUsers = false;
-
   programs.fish.enable = true;
-  security.sudo.wheelNeedsPassword = false;
 
   ## disable that slow "building man-cache" step
   documentation.man.generateCaches = lib.mkForce false;
diff --git a/profiles/network/firewall.nix b/profiles/network/firewall.nix
new file mode 100644
index 0000000..1b30c84
--- /dev/null
+++ b/profiles/network/firewall.nix
@@ -0,0 +1,10 @@
+{ ... }:
+{
+  networking = {
+    firewall = {
+      enable = false;
+      allowPing = true;
+      logRefusedConnections = false;
+    };
+  };
+}
diff --git a/profiles/server.nix b/profiles/server.nix
index 82a20c7..593dd44 100644
--- a/profiles/server.nix
+++ b/profiles/server.nix
@@ -2,19 +2,10 @@
   ...
 }:
 {
-
   imports = [
     ./default.nix
   ];
 
-  networking = {
-    firewall = {
-      enable = false;
-      allowPing = true;
-      logRefusedConnections = false;
-    };
-  };
-
   # Used by systemd-resolved, not directly by resolv.conf.
   networking.nameservers = [
     "8.8.8.8#dns.google"
@@ -24,6 +15,4 @@
   users.users.root.openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"
   ];
-
-  networking.firewall.allowedTCPPorts = [ 22 ];
 }