diff --git a/public/environment.nix b/public/environment.nix index 15fd39b..38746bc 100644 --- a/public/environment.nix +++ b/public/environment.nix @@ -23,6 +23,9 @@ in # Lancement de dbus pour les utilisateurs services.dbus.socketActivated = true; + # NixOS Hardening + security.grsecurity.enable = true; + # Paquets environment = { systemPackages = with pkgs; [ diff --git a/public/service-hydra-build.nix b/public/service-hydra-build.nix index e997a30..98a6453 100644 --- a/public/service-hydra-build.nix +++ b/public/service-hydra-build.nix @@ -20,9 +20,10 @@ mkIf cfg.hydra-builder { nix.gc.automatic = true; users.users."hydrabld" = { - description = "Execution des job hydra"; + description = "Execution des jobs hydra"; group = "nixbld"; - isNormalUser = false; + extraGroups = [ "nixbld" ]; + isNormalUser = true; openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYpjcWJCf8dXpv2LmoIaNVbwZXEC50QUU6Az+lqeD89 hydra radx"