more work

modules/nixos/system/security/boot.nix

@@ -0,0 +1,46 @@
+{ config, namespace, inputs, ... }:
+let
+  cfg = config.${namespace}.system.security.boot;
+in
+{
+  options.${namespace}.system.security.boot = {};
+
+  config = {
+    boot = {
+      kernelModules = [ "tcp_bbr" ];
+      kernel.sysctl = {
+        ## TCP hardening
+        # Prevent bogus ICMP errors from filling up logs.
+        "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+        # Reverse path filtering causes the kernel to do source validation of
+        # packets received from all interfaces. This can mitigate IP spoofing.
+        "net.ipv4.conf.default.rp_filter" = 1;
+        "net.ipv4.conf.all.rp_filter" = 1;
+        # Do not accept IP source route packets (we're not a router)
+        "net.ipv4.conf.all.accept_source_route" = 0;
+        "net.ipv6.conf.all.accept_source_route" = 0;
+        # Don't send ICMP redirects (again, we're on a router)
+        "net.ipv4.conf.all.send_redirects" = 0;
+        "net.ipv4.conf.default.send_redirects" = 0;
+        # Refuse ICMP redirects (MITM mitigations)
+        "net.ipv4.conf.all.accept_redirects" = 0;
+        "net.ipv4.conf.default.accept_redirects" = 0;
+        "net.ipv4.conf.all.secure_redirects" = 0;
+        "net.ipv4.conf.default.secure_redirects" = 0;
+        "net.ipv6.conf.all.accept_redirects" = 0;
+        "net.ipv6.conf.default.accept_redirects" = 0;
+        # Protects against SYN flood attacks
+        "net.ipv4.tcp_syncookies" = 1;
+        # Incomplete protection again TIME-WAIT assassination
+        "net.ipv4.tcp_rfc1337" = 1;
+
+        ## TCP optimization
+        # Enable TCP Fast Open for incoming and outgoing connections
+        "net.ipv4.tcp_fastopen" = 3;
+        # Bufferbloat mitigations + slight improvement in throughput & latency
+        "net.ipv4.tcp_congestion_control" = "bbr";
+        "net.core.default_qdisc" = "cake";
+      };
+    };
+  };
+}

modules/nixos/system/security/default.nix

@@ -0,0 +1,23 @@
+{ config, namespace, inputs, ... }:
+let
+  cfg = config.${namespace}.system.security;
+in
+{
+  options.${namespace}.system.security = {};
+
+  config = {
+    security = {
+      acme.acceptTerms = true;
+      polkit.enable = true;
+
+      pam = {
+        u2f = {
+          enable = true;
+          settings.cue = true;
+        };
+      };
+    };
+
+    programs.gnupg.agent.enable = true;
+  };
+}

modules/nixos/system/security/sops.nix

@@ -0,0 +1,22 @@
+{ pkgs, config, namespace, inputs, ... }:
+let
+  cfg = config.${namespace}.system.security.sops;
+in
+{
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
+  options.${namespace}.system.security.sops = {};
+
+  config = {
+    environment.systemPackages = with pkgs; [ sops ];
+
+    sops = {
+      defaultSopsFile = ../../../../secrets/secrets.yaml;
+      defaultSopsFormat = "yaml";
+
+      age.keyFile = "/home/";
+    };
+  };
+}

modules/nixos/system/security/sudo.nix

@@ -0,0 +1,23 @@
+{ config, namespace, ... }:
+let
+  cfg = config.${namespace}.system.security.sudo;
+in
+{
+  options.${namespace}.system.security.sudo = {};
+
+  config = {
+    security = {
+      sudo = {
+        enable = false;
+        execWheelOnly = true;
+      };
+      
+      sudo-rs = {
+        enable = true;
+        extraConfig = ''
+          Defaults env_keep += "EDITOR PATH DISPLAY"
+        '';
+      };
+    };
+  };
+}