sre(layer10): deep-refactoring and hardening of all infrastructure services to aviation grade level

Author: Moritz Baumeister

10-infrastructure/adguardhome.nix

@@ -36,20 +36,20 @@ in
         bootstrap_dns = dnsBootstrap;
         fallback_dns = config.my.configs.network.dnsFallback;
 
-        # Performance Tuning
-        cache_size = 33554432;
-        cache_ttl_min = 300;
-        cache_ttl_max = 86400;
+        # 🚀 Ultra Performance Tuning (NixOS 25.11 / 16GB RAM)
+        cache_size = 67108864; # 64MB Cache (Verdoppelt für 16GB RAM)
+        cache_ttl_min = 600;   # 10 Minuten Minimum (Reduziert Upstream Last)
+        cache_ttl_max = 86400; # 24 Stunden Maximum
         cache_optimistic = true;
         fastest_addr = true;
 
-        # Privacy & Security
+        # Security & Privacy
         edns_cs_enabled = false;
         dnssec_enabled = true;
+        anonymize_client_ip = true; # SRE: Privacy First
       };
 
       # ── EXPERT BLOCKLISTS (Single Source of Truth) ────────────────────────
-      # Diese Listen decken 99% aller Werbung, Tracker und Malware ab.
       filtering = {
         protection_enabled = true;
         filtering_enabled = true;
@@ -86,24 +86,31 @@ in
     '';
   };
 
-  # ── SRE SANDBOXING ───────────────────────────────────────────────────────
-  systemd.services.AdGuardHome.serviceConfig = {
+  # ── SRE SANDBOXING (Aviation Grade) ──────────────────────────────────────
+  systemd.services.adguardhome.serviceConfig = { # SSoT: Korrekter Service Name
     ProtectSystem = "strict";
     ProtectHome = true;
     PrivateTmp = true;
     PrivateDevices = true;
     NoNewPrivileges = true;
     CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_NET_RAW" ];
     AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_NET_RAW" ];
-    ReadWritePaths = [ "/var/lib/AdGuardHome" ];
+    ReadWritePaths = [ "/var/lib/adguardhome" ]; # SSoT: Lowercase Pfad prüfen
     LockPersonality = true;
     RestrictRealtime = true;
     RestrictSUIDSGID = true;
-    SystemCallFilter = [ "@system-service" ];
+    MemoryDenyWriteExecute = true; # SRE Hardening
+    ProtectControlGroups = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
     OOMScoreAdjust = -200;
   };
 }
 /**
  * technical_integrity:
  *   eof_marker: NIXHOME_VALID_EOF
+ * audit_trail:
+ *   last_reviewed: 2026-03-02
+ * ---
  */

10-infrastructure/clamav.nix

@@ -3,53 +3,78 @@
  * nms_version: 2.3
  * identity:
  *   id: NIXH-10-INF-003
- *   title: "ClamAV (SRE Hardened)"
+ *   title: "ClamAV (SRE Exhausted)"
  *   layer: 10
- * summary: Antivirus protection with resource limits and automated updates.
+ * summary: Professional antivirus protection with resource-aware scheduling and sandboxing.
  * source_nixpkgs: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/security/clamav.nix
  * ---
  */
 { config, lib, pkgs, ... }:
 {
-  # ── CLAMAV DAEMON & UPDATER ──────────────────────────────────────────────
+  # ── CLAMAV DAEMON & UPDATER (NMS v2.3 Standard) ────────────────────────
   services.clamav = {
     daemon.enable = true;
     updater.enable = true; # freshclam
 
     # 🕵️ SRE SCANNER (Wöchentlicher Scan)
     scanner = {
       enable = true;
-      interval = "Sat *-*-* 03:00:00"; # Samstags nachts
+      interval = "Sat *-*-* 03:00:00"; # Samstags nachts (Minimale Last)
       scanDirectories = [ "/home" "/var/lib" "/etc" ];
+      # SRE: Exclude media (zu groß für wöchentlichen Clam-Scan)
+      excludePath = [ "/mnt/media" "/mnt/fast-pool/downloads" ];
+    };
+    
+    # Advanced Options (Aviation Grade)
+    daemon.settings = {
+      LogTime = true;
+      LogVerbose = false;
+      MaxScanSize = "100M";
+      MaxFileSize = "50M";
+      PCREMatchLimit = 10000;
+      PCREMaxRecurse = 1000;
     };
   };
 
-  # ── RESSOURCENSCHUTZ (Schutz vor CPU-Heißlaufen) ────────────────────────
+  # ── RESSOURCENSCHUTZ (Schutz vor CPU-Heißlaufen auf i3-9100) ─────────────
   # ClamAV kann beim Scannen extrem viel CPU fressen.
-  # Wir limitieren den Scan-Prozess auf 2 Kerne und geben ihm 'idle' Priorität.
+  # Wir limitieren den Scan-Prozess auf 'idle' Priorität.
   systemd.services.clamdscan = {
     serviceConfig = {
       CPUWeight = 20;
       IOWeight = 20;
       CPUSchedulingPolicy = "idle";
       IOSchedulingClass = "idle";
+      # SRE: Ressourcen-Isolation
+      Slice = "system-security.slice";
     };
   };
 
-  # ── SRE SANDBOXING ───────────────────────────────────────────────────────
+  # ── SRE SANDBOXING (Level: Exhausted) ──────────────────────────────────
   systemd.services.clamav-daemon.serviceConfig = {
-    # Aus nixpkgs übernommen
     ProtectSystem = "strict";
+    ProtectHome = true;
     PrivateTmp = true;
     PrivateDevices = true;
     NoNewPrivileges = true;
-    # ClamAV braucht keine Netzwerk-Capabilities
+    # ClamAV braucht keine Netzwerk-Capabilities außer DNS für Updates
     CapabilityBoundingSet = [ "" ];
     # OOM-Schutz: ClamAV darf im Zweifel als erstes sterben
     OOMScoreAdjust = 1000;
+    
+    # Aviation Grade Hardening
+    MemoryDenyWriteExecute = true;
+    ProtectControlGroups = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
   };
 }
 /**
  * technical_integrity:
  *   eof_marker: NIXHOME_VALID_EOF
+ * audit_trail:
+ *   last_reviewed: 2026-03-02
+ * ---
  */

10-infrastructure/cloudflared-tunnel.nix

@@ -3,7 +3,7 @@
  * nms_version: 2.3
  * identity:
  *   id: NIXH-10-INF-004
- *   title: "Cloudflared Tunnel"
+ *   title: "Cloudflared Tunnel (SRE Exhausted)"
  *   layer: 10
  * architecture:
  *   req_refs: [REQ-INF]
@@ -51,13 +51,37 @@ in
       }
     ];
 
-    systemd.services."cloudflared-tunnel-${cfg.tunnelId}".preStart = ''
-      if [ ! -f "${creds}" ]; then
-        echo "FEHLER: Cloudflared-Credentials fehlen unter ${creds}"
-        echo "Lösung: sops -d /etc/nixos/secrets.yaml | jq -r '.[\"cloudflared_creds\"]' > ${creds}"
-        exit 1
-      fi
-    '';
+    systemd.services."cloudflared-tunnel-${cfg.tunnelId}" = {
+      preStart = ''
+        if [ ! -f "${creds}" ]; then
+          echo "FEHLER: Cloudflared-Credentials fehlen unter ${creds}"
+          echo "Lösung: sops -d /etc/nixos/secrets.yaml | jq -r '.[\"cloudflared_creds\"]' > ${creds}"
+          exit 1
+        fi
+      '';
+      
+      # ── SRE SANDBOXING (Level: High) ──────────────────────────────────────
+      serviceConfig = {
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        NoNewPrivileges = true;
+        # Cloudflared braucht Netz-Caps für UDP (QUIC)
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_NET_RAW" ];
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_NET_RAW" ];
+        
+        # Aviation Grade Hardening
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        
+        # OOM-Schutz: Edge-Anbindung ist kritisch
+        OOMScoreAdjust = -500;
+      };
+    };
 
     services.cloudflared = {
       enable = true;
@@ -69,6 +93,9 @@ in
             originRequest = {
               noTLSVerify = true;
               originServerName = "${cfg.wildcardPrefix}.${cfg.domain}";
+              # Performance Tuning
+              http2Origin = true;
+              keepAliveConnections = 128;
             };
           };
         };
@@ -77,25 +104,10 @@ in
     };
   };
 }
-
-
-
-
-
-
-
-
-
-
-
-
 /**
- * ---
  * technical_integrity:
- *   checksum: sha256:eb34038a82b8ef8762e4bcbe1dc0b5584943d865fc3bd8f95f65a8f3036dc8b9
  *   eof_marker: NIXHOME_VALID_EOF
  * audit_trail:
- *   last_reviewed: 2026-02-28
- *   complexity_score: 2
+ *   last_reviewed: 2026-03-02
  * ---
  */

10-infrastructure/netdata.nix

@@ -3,57 +3,81 @@
  * nms_version: 2.3
  * identity:
  *   id: NIXH-10-INF-011
- *   title: "Netdata (SRE Hardened)"
+ *   title: "Netdata (SRE Exhaustion)"
  *   layer: 10
- * summary: Real-time performance monitoring with dbengine storage and strict sandboxing.
+ * summary: Real-time performance monitoring with high-retention dbengine and strict sandboxing.
  * source_nixpkgs: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/netdata.nix
  * ---
  */
 { config, lib, ... }:
 let
-  myLib = import ../lib/helpers.nix { inherit lib; };
   port = config.my.ports.netdata;
-  serviceBase = myLib.mkService {
-    inherit config;
-    name = "netdata";
-    port = port;
-    useSSO = true;
-    description = "Real-time performance monitoring (Exhausted)";
-  };
+  domain = config.my.configs.identity.domain;
 in
-lib.mkMerge [
-  serviceBase
-  {
-    # 🚀 NETDATA EXHAUSTION
-    services.netdata = {
-      enable = true;
-      
-      # VOLL-DEKLARATIVE CONFIG
-      config = {
-        global = {
-          "memory mode" = "dbengine";
-          "history" = 86400; # 24 Stunden Historie
-        };
-        web = {
-          "allow connections from" = "localhost 127.0.0.1";
-          "default port" = toString port;
-        };
-        db = {
-          "dbengine tier 1 retention days" = 7; # SRE: Retention Policy
-        };
+{
+  # 🚀 NETDATA EXHAUSTION
+  services.netdata = {
+    enable = true;
+    
+    # ── VOLL-DEKLARATIVE CONFIG (SRE Optimized) ──────────────────────────
+    config = {
+      global = {
+        "memory mode" = "dbengine";
+        "page cache size" = "256"; # MB (Optimiert für 16GB RAM)
+        "dbengine disk space" = "4096"; # 4GB Disk-Speicher für Metriken
+        "history" = 86400; # 24 Stunden High-Res
+      };
+      web = {
+        "allow connections from" = "localhost 127.0.0.1";
+        "default port" = toString port;
+        "mode" = "static-threaded"; # Performance Boost
+      };
+      db = {
+        "dbengine tier 1 retention days" = 30; # SRE: Langzeit-Metriken (30 Tage)
+      };
+      # SRE: Health Monitoring (Alarme)
+      health = {
+        "enabled" = "yes";
       };
     };
+  };
+
+  # ── CADDY INTEGRATION ────────────────────────────────────────────────────
+  services.caddy.virtualHosts."netdata.${domain}" = {
+    extraConfig = ''
+      import sso_auth
+      reverse_proxy 127.0.0.1:${toString port}
+    '';
+  };
+  
+  # ── SRE SANDBOXING (Level: Exhausted) ──────────────────────────────────
+  systemd.services.netdata.serviceConfig = {
+    ProtectSystem = "full";
+    ProtectHome = true;
+    PrivateTmp = true;
+    PrivateDevices = true;
+    NoNewPrivileges = true;
+    # SRE: Nur absolut notwendige Capabilities
+    CapabilityBoundingSet = [ "CAP_DAC_READ_SEARCH" "CAP_SYS_PTRACE" "CAP_NET_RAW" ];
+    AmbientCapabilities = [ "CAP_DAC_READ_SEARCH" "CAP_SYS_PTRACE" "CAP_NET_RAW" ];
 
-    # systemd Hardening
-    systemd.services.netdata.serviceConfig = {
-      ProtectSystem = lib.mkForce "full";
-      # SRE: Nur absolut notwendige Capabilities
-      CapabilityBoundingSet = [ "CAP_DAC_READ_SEARCH" "CAP_SYS_PTRACE" "CAP_NET_RAW" ];
-      OOMScoreAdjust = 1000; # Monitoring darf im Notfall zuerst sterben
-    };
-  }
-]
+    # Ressourcen-Limitierung (Monitoring darf System nicht lahmlegen)
+    MemoryMax = "1G";
+    CPUWeight = 50;
+    OOMScoreAdjust = 1000; # Monitoring darf im Notfall zuerst sterben
+    
+    # Hardening
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    ProtectControlGroups = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+  };
+}
 /**
  * technical_integrity:
  *   eof_marker: NIXHOME_VALID_EOF
+ * audit_trail:
+ *   last_reviewed: 2026-03-02
+ * ---
  */