superconfig/modules/ at a14a1ea48634835758014527f2a1b7a830135b93 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / modules

8 files

at a14a1ea48634835758014527f2a1b7a830135b93

lassulus configs: allocate uids dynamically, drop stockholm.lib 13d ago

configs: remove klem

1 week ago

fetchWallpaper.nix

modules: rename from 3modules

2 weeks ago

configs: allocate uids dynamically, drop stockholm.lib pairprogramming, radio, realwallpaper and the htgen users no longer get their ids from stockholm's genid. NixOS keeps the ids existing users already have in /etc/passwd and /etc/group, so nothing changes on deployed machines; fresh installs allocate them. The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option types instead of stockholm's, htgen's user is a small name/home submodule (home still defaults to /home/<name>), and reaktor2 carries its own stripAttr.

1 week ago

modules: rename from 3modules

2 weeks ago

configs: allocate uids dynamically, drop stockholm.lib pairprogramming, radio, realwallpaper and the htgen users no longer get their ids from stockholm's genid. NixOS keeps the ids existing users already have in /etc/passwd and /etc/group, so nothing changes on deployed machines; fresh installs allocate them. The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option types instead of stockholm's, htgen's user is a small name/home submodule (home still defaults to /home/<name>), and reaktor2 carries its own stripAttr.

1 week ago

realwallpaper.nix

configs: allocate uids dynamically, drop stockholm.lib pairprogramming, radio, realwallpaper and the htgen users no longer get their ids from stockholm's genid. NixOS keeps the ids existing users already have in /etc/passwd and /etc/group, so nothing changes on deployed machines; fresh installs allocate them. The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option types instead of stockholm's, htgen's user is a small name/home submodule (home still defaults to /home/<name>), and reaktor2 carries its own stripAttr.

1 week ago

modules: rename from 3modules

2 weeks ago

sync-containers3.nix

configs: replace krebs.iptables with the nftables firewall Every machine now uses networking.firewall on networking.nftables with the same defaults krebs.iptables had: input and forward drop, all ICMP accepted, no reverse path filter. Open ports and trusted interfaces are unchanged on all machines. - interface port rules become firewall.interfaces.<if>.allowed*Ports, interface-wide accepts trustedInterfaces - forwarding goes through extraForwardRules; yellow keeps forward unfiltered for the transmission namespace - NAT rules become per-module networking.nftables.tables - ssh-redirect: 45621 redirects to 22, new connections to 22 are reset unless they come from lo, retiolum or wiregrill - xerxes: the JOOL xtables target is added by jool-iptables through ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension - flushRuleset = false so libvirt/podman/jool tables survive reloads; extraDeletions drops the iptables-nft tables krebs.iptables left Rules that were silently ignored while networking.firewall was disabled, such as clan's yggdrasil filter, now take effect.

1 week ago