csd4ni3l/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues Pull requests Projects Releases 9 Packages Wiki Activity Actions
9 releases 9 tags
  • v0.5.3 d89fa6e83d

    v0.5.3 Stable

    csd4ni3l released this 2026-10-12 23:12:29 +02:00 | 23 commits to main since this release

    • pin every container to a specific version
    • update ntfy to v2.30.0
    • removed unneeded impermanence mounts on deploy user which could cause stale *.container and *.service files
    Downloads
  • v0.5.2 17ac68cdcd

    v0.5.2 Stable

    csd4ni3l released this 2026-10-12 22:09:04 +02:00 | 26 commits to main since this release

    Add confirmation + git diff to rebuild command

    Downloads
  • v0.5.1 15c708aac3

    v0.5.1 Stable

    csd4ni3l released this 2026-10-12 21:39:08 +02:00 | 29 commits to main since this release

    Revert adding of auto-update which can allow lateral movement from VPS to any other host, by only compromising the git repo. Instead, a custom rebuild alias is used now for the VMs too.

    Downloads
  • v0.5.0 1adcf1dd84

    v0.5.0 Stable

    csd4ni3l released this 2026-10-12 20:43:32 +02:00 | 31 commits to main since this release

    • switch all VMs from cachyos to linux mainline, they gained nothing from cachyos
    • new kernel_lockdown option that actually works: framework16 gets integrity, VMs get confidentiality
    • module.sig_enforce is now enabled too, it works on mainline
    • machine-id is random again instead of hardcoded in the config
    • faillock now covers run0, no longer silent, 30m unlock time
    • replaced nosuid on /nix with a build time suid checker, since nosuid also drops capabilities
    • dropped the plaintext NTP pools nixos enables by default
    • trimmed unneeded kernel modules from the VMs to shrink the attack surface
    • more blacklist entries: thunderbolt_stream, ip_vti, ip6_vti, nfc, radio tuners
    • remove host crowdsec on VPS, it never actually worked
    • steam is sandboxed now, so games and a compromised client stay in the jail
    • every sandboxed app gets a tmpfs ~/.cache, so a poisoned cache cannot persist
    • XDG_CONFIG_HOME set in all sandboxes, default jail trimmed of unneeded bind mounts
    • zed gets ~/.ssh and the git config read only, plus /usr/bin/env so eslint works
    • keyring-access combinator added to the jail lib, jail dirs now split per app so you can pick what you want
    • slick added, sandboxed, with declarative settings and a persistent session
    • fluxer canary packaged and sandboxed
    • mcp-gateway on homelabvm merges all mcps into one image behind one port and one bearer token
    • ntfy container plus freshrss, musicbrainz, lrclib, nixos and open-meteo mcps
    • open terminal mcp with its own image, more shell tools, works rootless
    • playwright mcp is now patchright in isolated mode
    • openwebui gets a persistent workdir
    • arkenfox user.js tracks master again
    • point /etc/ssl/cert.pem at the ca bundle, fixes tools like uv python
    • dmemcg-booster bumped to v0.1.3
    • forgejo actions bump nixpkgs, flake inputs and pinned container images every three days and open a PR
    • daily timer on every VM pulls the repo into /persist and rebuilds if the commit changed
    • daily podman auto-update timer for AutoUpdate=registry images
    • .gitignore added
    • README overhauled
    • flake.lock updated
    Downloads
  • v0.4.0 1fc6187afa

    sshd lockdown, mcp additions, firefox hardening, QOL changes, cleanup Stable

    csd4ni3l released this 2026-09-30 20:31:06 +02:00 | 93 commits to main since this release

    • add soulseek MCP container to homelabvm, kept on the openwebui network so it never faces the internet
    • build slsk_mcp from source with a small dest-dir patch
    • add navidrome MCP container to homelabvm, reading its secrets from rendered sops templates
    • lock down sshd further: 30s login grace, MaxStartups throttling, keepalives, no forwarding or tunnelling
    • bind degoog to localhost only (127.0.0.1:65001) instead of every interface
    • remove the unused checkmate container and its secrets
    • framework 16 now loads only redistributable firmware and stops force-loading thunderbolt
    • more firefox hardening: RFP pbmode and letterboxing, memory-only cache, no NOCERT database, DRM off
    • drop canvasblocker, RFP already covers it
    • swap qalculate for gnome-calculator
    • move noctalia greeter under services.displayManager, which clears the deprecation warning
    • disable the touchpad whenever an external mouse is plugged in
    • new dev tools: bun, gitleaks, sqlc and gosec
    • dnsutils added to the common CLI set
    • pangolin bumped to 1.23.0
    • flake substituters trimmed to the caches actually in use
    • README overhauled
    • flake.lock updated
    Downloads
  • v0.3.0 d429cf4a63

    v0.3.0 Stable

    csd4ni3l released this 2026-09-18 21:01:58 +02:00 | 116 commits to main since this release

    • add proper installation instructions
    • add VPS & anotherpublicvm hosts
    • add DNSCrypt to all hosts
    • add new crowdsec service to VPS
    • add pangolin, checkmate, mariadb containers
    • make wings and forgejo-runner services modular/dendritic
    • improve Firefox privacy by using RFP instead of canvasblocker
    • use gnome-calculator instead of qalculate
    • make OBS Studio configs declarative
    • fix some apps
    • fix SSH & fix disko install/nixos-anywhere not working for installation on new hosts
    • QOL changes
    • update flake.lock
    Downloads
  • v0.2.1 b0671c7a46

    v0.2.1 Stable

    csd4ni3l released this 2026-09-11 22:36:13 +02:00 | 158 commits to main since this release

    • switch from catpuccin-nix to stylix for theming
    • switch from catpuccin mocha to nord theme
    • update noctalia config for much better looks
    • remove the old wallpapers which weren't right for the theme, and add a new single one, remove automatic changes between wallpapers
    • update to latest nixos unstable version
    • fix forgejo by using env variables instead of app.ini for configuration
    • fix zed not adopting zsh configs due to missing .zshenv mount
    Downloads
  • v0.2.0 55fcadf684

    v0.2.0 Stable

    csd4ni3l released this 2026-09-09 17:37:45 +02:00 | 166 commits to main since this release

    • Switch to jail.nix from nixpak
    • fix lots of non-working containers like pelican panel, wings, etc
    • Update to newest nix version
    • add karakeep, degoog and openwebui containers
    • remove lots of stuff, rework random things, fix issues
    Downloads
  • v0.1.0 1e27bcc120

    v0.1.0 Stable

    csd4ni3l released this 2026-08-23 22:34:35 +02:00 | 217 commits to main since this release

    The first actual release of this project!

    Downloads