diff --git a/base/base.nix b/base/base.nix index b570e8e..54a51df 100644 --- a/base/base.nix +++ b/base/base.nix @@ -2,8 +2,7 @@ { imports = [ - ./networking.nix - ./services.nix + ./network-dns.nix # inclusion conditionnelle ./activation-manuelle/fail2ban.nix diff --git a/base/network-dns.nix b/base/network-dns.nix new file mode 100644 index 0000000..008c289 --- /dev/null +++ b/base/network-dns.nix @@ -0,0 +1,14 @@ +{ config, pkgs, ... }: + +{ + # Définition des domaines utilisés lorsque un identifiant non-FQDN est donné (ping, nslookup) + networking = { + search = [ + "dubronetwork.fr" + "prunetwork.fr" + "teleragno.fr" + "teleragno.net" + ]; + dnsExtensionMechanism = true; + }; +} diff --git a/base/networking.nix b/public/network-ipv6.nix similarity index 68% rename from base/networking.nix rename to public/network-ipv6.nix index 5763240..5b06a58 100644 --- a/base/networking.nix +++ b/public/network-ipv6.nix @@ -1,17 +1,6 @@ { config, pkgs, ... }: { - # Définition des domaines utilisés lorsque un identifiant non-FQDN est donné (ping, nslookup) - networking = { - search = [ - "dubronetwork.fr" - "prunetwork.fr" - "teleragno.fr" - "teleragno.net" - ]; - dnsExtensionMechanism = true; - }; - # Utilisation d'adresse IPv6 temporaire ## https://blog.linitx.com/control-privacy-addressing-ipv6-linux/ diff --git a/public/public.nix b/public/public.nix index 17a2e9e..662819e 100644 --- a/public/public.nix +++ b/public/public.nix @@ -5,7 +5,10 @@ # installées systématiquement ./environment.nix ./localisation.nix + ./network-ipv6.nix + ./service-haveged.nix ./service-monitoring.nix + ./service-ssh.nix # commandées par config-generator ## option de configuration spécifique diff --git a/public/service-haveged.nix b/public/service-haveged.nix new file mode 100644 index 0000000..0d29e12 --- /dev/null +++ b/public/service-haveged.nix @@ -0,0 +1,12 @@ +{ config, pkgs, ... }: + +{ + # Sécurité & Acces distant + + ## Augmentation de l'entropie du système par un générateur de nombres aléatoires + ## cat /proc/sys/kernel/random/entropy_avail + services.haveged = { + enable = true; + refill_threshold = 2048; + }; +} diff --git a/base/services.nix b/public/service-ssh.nix similarity index 78% rename from base/services.nix rename to public/service-ssh.nix index 1609c6c..f6d55cb 100644 --- a/base/services.nix +++ b/public/service-ssh.nix @@ -1,16 +1,7 @@ { config, pkgs, ... }: { - # Sécurité & Acces distant - - ## Augmentation de l'entropie du système par un générateur de nombres aléatoires - ## cat /proc/sys/kernel/random/entropy_avail - services.haveged = { - enable = true; - refill_threshold = 2048; - }; - - ## OpenSSH daemon + # OpenSSH daemon services.openssh = { enable = true; # https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Modern_.28OpenSSH_6.7.2B.29