chore: security hardening

config/network.nix

@@ -9,7 +9,14 @@
     openssh = {
       enable = true;
       openFirewall = true;
+
+      allowSFTP = false;
+      challengeResponseAuthentication = false;
       settings = {
+        AllowAgentForwarding = false;
+        AllowStreamLocalForwarding = false;
+        AllowTcpForwarding = true;
+        AuthenticationMethods = "publickey";
         KexAlgorithms = [
           "curve25519-sha256"
           "curve25519-sha256@libssh.org"
@@ -19,7 +26,7 @@
         ];
         PasswordAuthentication = false;
         PermitRootLogin = "prohibit-password";
-        StreamLocalBindUnlink = "yes";
+        X11Forwarding = false;
       };
     };
   };

config/nix.nix

@@ -7,10 +7,8 @@
         "nix-command"
         "flakes"
       ];
-      trusted-users = [
-        "@wheel"
-        "winston"
-      ];
+      allowed-users = [ "root" ];
+      trusted-users = [ "root" ];
     };
   };
 }

flake.nix

@@ -22,8 +22,15 @@
           modules = [
             {
               nixpkgs = {
-                config.allowUnfree = true;
                 inherit overlays;
+                config.allowUnfreePredicate =
+                  pkg:
+                  builtins.elem (nixpkgs.lib.getName pkg) [
+                    "elasticsearch"
+                    "satisfactory-server"
+                    "steamworks-sdk-redist"
+                    "valheim-server"
+                  ];
               };
             }
             ./hosts/main-node
@@ -65,12 +72,10 @@
 
           devShells.default = pkgs.mkShell {
             inherit (config.pre-commit.devShell) shellHook;
-            buildInputs = [
+            packages = [
               inputs'.agenix.packages.agenix
               pkgs.age-plugin-yubikey
               pkgs.unstable.deploy-rs
-              pkgs.unstable.nh
-              pkgs.unstable.nixd
               self'.formatter
             ];
           };

modules/wakapi.nix

@@ -30,6 +30,7 @@ let
         Group = "wakapi";
 
         DynamicUser = true;
+        NoNewPrivileges = true;
         ProtectHome = true;
         ProtectHostname = true;
         ProtectKernelLogs = true;