···

       
20
       
 
       
  config = mkIf cfg.timeserver.enable {

     

       
21
       
 
       
    networking.timeServers = [

     

       
22
       
 
       
      "time.cloudflare.com"

     

       
23
       
-
       
      "uk.pool.ntp.org"

     

       
0
       
 
       

     

       
24
       
 
       
    ];

     

       
25
       
 
       


     

       
26
       
 
       
    services.chrony = {

     

       
27
       
 
       
      enable = true;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
28
       
 
       
      extraConfig = ''

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
29
       
 
       
        allow all

     

       
30
       
 
       
        ${bindDevices}

     

       
31
       
 
       
      '';

     

       
32
       
 
       
    };

     

       
33
       
 
       


     

       
0
       
 
       

     

       
34
       
 
       
    services.ntp.enable = false;

     

       
35
       
 
       
    services.openntpd.enable = false;

     

       
36
       
 
       
  };

     

···

       
20
       
 
       
  config = mkIf cfg.timeserver.enable {

     

       
21
       
 
       
    networking.timeServers = [

     

       
22
       
 
       
      "time.cloudflare.com"

     

       
23
       
+
       
      "ntppool1.time.nl"

     

       
24
       
+
       
      "ptbtime1.ptb.de"

     

       
25
       
 
       
    ];

     

       
26
       
 
       


     

       
27
       
 
       
    services.chrony = {

     

       
28
       
 
       
      enable = true;

     

       
29
       
+
       
      extraFlags = mkDefault [

     

       
30
       
+
       
        "-F 1" # seccomp filter

     

       
31
       
+
       
        "-r" # reload history on restart

     

       
32
       
+
       
      ];

     

       
33
       
+
       
      initstepslew.enabled = mkDefault false;

     

       
34
       
+
       
      enableRTCTrimming = mkDefault false;

     

       
35
       
+
       
      enableNTS = mkDefault true;

     

       
36
       
 
       
      extraConfig = ''

     

       
37
       
+
       
        minsources 3

     

       
38
       
+
       
        authselectmode require

     

       
39
       
+
       
        dscp 46

     

       
40
       
+
       
        makestep 1.0 3

     

       
41
       
+
       
        cmdport 0

     

       
42
       
+
       
        noclientlog

     

       
43
       
+
       
        ${strings.optionalString (!config.services.chrony.enableRTCTrimming) "rtcsync"}

     

       
44
       
 
       
        allow all

     

       
45
       
 
       
        ${bindDevices}

     

       
46
       
 
       
      '';

     

       
47
       
 
       
    };

     

       
48
       
 
       


     

       
49
       
+
       
    services.timesyncd.enable = false;

     

       
50
       
 
       
    services.ntp.enable = false;

     

       
51
       
 
       
    services.openntpd.enable = false;

     

       
52
       
 
       
  };

     

···

       
21
       
 
       
    services.openssh = {

     

       
22
       
 
       
      enable = true;

     

       
23
       
 
       
    } // helpers.linuxAttrs {

     

       
0
       
 
       

     

       
24
       
 
       
      openFirewall = mkDefault (!config.modules.router.enable);

     

       
25
       
 
       
      ports = [ 22 2222 ];

     

       
26
       
 
       
    };

     

···

       
21
       
 
       
    services.openssh = {

     

       
22
       
 
       
      enable = true;

     

       
23
       
 
       
    } // helpers.linuxAttrs {

     

       
24
       
+
       
      settings.PermitRootLogin = mkDefault "no";

     

       
25
       
 
       
      openFirewall = mkDefault (!config.modules.router.enable);

     

       
26
       
 
       
      ports = [ 22 2222 ];

     

       
27
       
 
       
    };