base/hardening: ban a few more modules

base/mitigations.nix

@@ -1,6 +1,7 @@
-{ pkgs, lib, ... }:
+{ ... }:
-let
+
-  modulesToBan = [
+{
+  boot.blacklistedKernelModules = [
     # copy.fail
     "af_alg"
     "algif_aead"
@@ -16,9 +17,4 @@ let
     # PinTheft
     "rds"
   ];
-in
-{
-  boot.blacklistedKernelModules = modulesToBan;
-
-  boot.extraModprobeConfig = lib.concatMapStringsSep "\n" (mod: "install ${mod} ${lib.getExe' pkgs.coreutils "false"}") modulesToBan;
 }

hosts/bicep/services/matrix/livekit.nix

@@ -64,11 +64,4 @@ in
       '';
     };
   };
-
-  networking.firewall.allowedUDPPortRanges = [
-    {
-      from = cfg.settings.rtc.port_range_start;
-      to = cfg.settings.rtc.port_range_end;
-    }
-  ];
 }

hosts/bicep/services/postgresql/cleanup-timers.nix

@@ -1,37 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.postgresql;
-in
-{
-  config = lib.mkIf cfg.enable {
-    systemd.services = {
-      postgresql-repack = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.target" ];
-        description = "Repack all PostgreSQL databases";
-        startAt = "Mon 06:00:00";
-        serviceConfig = {
-          Type = "oneshot";
-          User = "postgres";
-          Group = "postgres";
-
-          ExecStart = "${lib.getExe cfg.package.pkgs.pg_repack} --port=${builtins.toString cfg.settings.port} --all";
-        };
-      };
-
-      postgresql-vacuum-analyze = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.target" ];
-        description = "Vacuum and analyze all PostgreSQL databases";
-        startAt = "Tue 06:00:00";
-        serviceConfig = {
-          Type = "oneshot";
-          User = "postgres";
-          Group = "postgres";
-
-          ExecStart = "${lib.getExe' cfg.package "psql"} --port=${builtins.toString cfg.settings.port} -tAc 'VACUUM ANALYZE'";
-        };
-      };
-    };
-  };
-}

hosts/bicep/services/postgresql/default.nix

@@ -3,15 +3,11 @@ let
   cfg = config.services.postgresql;
 in
 {
-  imports = [
+  imports = [ ./backup.nix ];
-    ./backup.nix
-    ./cleanup-timers.nix
-  ];
 
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_18;
-    extensions = ps: with ps; [ pg_repack ];
     enableTCPIP = true;
 
     authentication = ''