From 4c5ac2fa0edb1c15094cfdc35021109bc08ecdf5 Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Wed, 10 Jul 2024 00:46:20 +0200
Subject: [PATCH] add global hardening options

---
 common/default.nix   |  1 +
 common/hardening.nix | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 common/hardening.nix

diff --git a/common/default.nix b/common/default.nix
index 0054de1..9af4a43 100644
--- a/common/default.nix
+++ b/common/default.nix
@@ -5,5 +5,6 @@
     ./raito-proxy-aware-nginx.nix
     ./base-server.nix
     ./sysadmin
+    ./hardening.nix
   ];
 }
diff --git a/common/hardening.nix b/common/hardening.nix
new file mode 100644
index 0000000..e3b6df2
--- /dev/null
+++ b/common/hardening.nix
@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+
+{
+  nix.settings.allowed-users = [ "root" ];
+
+  boot.specialFileSystems = lib.mkIf (!config.security.rtkit.enable && !config.security.polkit.enable) {
+    "/proc".options = [ "hidepid=2" ];
+  };
+
+  boot.kernel.sysctl."kernel.dmesg_restrict" = 1;
+
+  services.openssh = {
+    settings.PasswordAuthentication = false;
+    settings.KbdInteractiveAuthentication = false;
+
+    # prevents mutable /home/$user/.ssh/authorized_keys from being loaded to ensure that all user keys are config managed
+    authorizedKeysFiles = lib.mkForce [
+      "/etc/ssh/authorized_keys.d/%u"
+    ];
+  };
+
+  users.mutableUsers = false;
+}