Concepts
Security baseline
One option, nixmsp.security.baseline, and what each value is meant to change.
The security feature has one switch: nixmsp.security.baseline. It takes standard (the default) or strict.
standard |
strict |
|
|---|---|---|
| sudo | Asks for a password | Asks for a password |
| SSH | NixOS defaults | Key-only, no root login |
| fail2ban | Off | On |
| Authorized keys | Optional | Required |
Options
nixmsp.security.baseline:standardorstrict.nixmsp.security.authorizedKeys: SSH public keys allowed to log in as the admin user.nixmsp.security.adminUser: the account that receives those keys. Defaults toadmin. It must exist, so declare it in the host.
It refuses to lock you out
strict turns off SSH passwords. If authorizedKeys is empty, evaluation fails with this message:
nixmsp.security.baseline = “strict” disables SSH passwords, so nixmsp.security.authorizedKeys must not be empty.
That check is an assertion in features/security.nix.
Status
This is written but not evaluated. The table describes what the code is meant to do. Confirm it with the demo in the Quick start once Nix has evaluated the scaffold.
Sudo requires a password by default through mkDefault, so a host can override it.
Not covered yet
Secrets management, disk encryption and a fleet-wide audit are not part of the baseline. Secrets are the first item on the Roadmap.