From 06df535e843c8bbdfb7fbf522e8a96e7c5c5c69b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Laure=CE=B7t?= <laurent@fainsin.bzh>
Date: Fri, 23 Dec 2022 15:32:11 +0100
Subject: [PATCH] feat: enable hardened kernel

---
 hosts/neodymium/configuration.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hosts/neodymium/configuration.nix b/hosts/neodymium/configuration.nix
index a6392ec..82c66bf 100644
--- a/hosts/neodymium/configuration.nix
+++ b/hosts/neodymium/configuration.nix
@@ -10,14 +10,17 @@ let
   };
 
 in {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [
+    <nixpkgs/nixos/modules/profiles/hardened.nix>
+    ./hardware-configuration.nix
+  ];
 
   # networking
   networking.hostName = "neodymium";
   networking.networkmanager.enable = true;
   networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [];
-  networking.firewall.allowedUDPPorts = [];
+  networking.firewall.allowedTCPPorts = [ ];
+  networking.firewall.allowedUDPPorts = [ ];
 
   # use systemd-boot EFI boot loader
   boot.loader.systemd-boot.enable = true;