diff options
| author | Aargh Rai <aargh.rai+git@gmail.com> | 2026-07-29 17:30:51 +0530 |
|---|---|---|
| committer | Aargh Rai <aargh.rai+git@gmail.com> | 2026-07-29 17:30:51 +0530 |
| commit | da900f6014b8fa65c5e097acfe6d949aee4a4179 (patch) | |
| tree | e5334816f35cc5558fd4174a1e943372d5fd42c4 /nixos | |
| parent | b2892a0bec1dd18d70369c5d5025eba07b0d31c6 (diff) | |
ventoy & tailscale
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/environment.nix | 1 | ||||
| -rw-r--r-- | nixos/opt/tailscale.nix | 7 | ||||
| -rw-r--r-- | nixos/services.nix | 8 |
3 files changed, 8 insertions, 8 deletions
diff --git a/nixos/environment.nix b/nixos/environment.nix index 9ab3d7e..c29c8bf 100644 --- a/nixos/environment.nix +++ b/nixos/environment.nix @@ -79,6 +79,7 @@ termshark mitmproxy certmitm + ventoy ]; fonts.packages = with pkgs; [ dejavu_fonts diff --git a/nixos/opt/tailscale.nix b/nixos/opt/tailscale.nix index a14c93b..50244cb 100644 --- a/nixos/opt/tailscale.nix +++ b/nixos/opt/tailscale.nix @@ -1,24 +1,17 @@ { config, pkgs, ... }: { - # 1. Enable the service and the firewall services.tailscale.enable = true; networking.nftables.enable = true; networking.firewall = { enable = true; - # Always allow traffic from your Tailscale network trustedInterfaces = [ "tailscale0" ]; - # Allow the Tailscale UDP port through the firewall allowedUDPPorts = [ config.services.tailscale.port ]; }; - # 2. Force tailscaled to use nftables (Critical for clean nftables-only systems) - # This avoids the "iptables-compat" translation layer issues. systemd.services.tailscaled.serviceConfig.Environment = [ "TS_DEBUG_FIREWALL_MODE=nftables" ]; - # 3. Optimization: Prevent systemd from waiting for network online - # (Optional but recommended for faster boot with VPNs) systemd.network.wait-online.enable = false; boot.initrd.systemd.network.wait-online.enable = false; } diff --git a/nixos/services.nix b/nixos/services.nix index 2cbd8b5..38634b2 100644 --- a/nixos/services.nix +++ b/nixos/services.nix @@ -29,7 +29,13 @@ wireplumber.enable = true; }; services.cloudflare-warp.enable = true; - services.openssh.enable = true; + services.openssh = { + enable = true; + settings = { + PasswordAuthentication = false; + PermitRootLogin = "no"; + }; + }; services.flatpak.enable = true; services.kanata = { enable = true; |