From d9747c64b038943253eaafdc59a49d5face46dab Mon Sep 17 00:00:00 2001
From: Fuwn <contact@fuwn.me>
Date: Fri, 20 Sep 2024 05:36:20 -0700
Subject: modules: server and core modules

---
 modules/core/security/pam.nix | 50 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 modules/core/security/pam.nix

(limited to 'modules/core/security/pam.nix')

diff --git a/modules/core/security/pam.nix b/modules/core/security/pam.nix
new file mode 100644
index 0000000..b7eb426
--- /dev/null
+++ b/modules/core/security/pam.nix
@@ -0,0 +1,50 @@
+{
+  security = {
+    pam = {
+      loginLimits = [
+        {
+          domain = "@wheel";
+          item = "nofile";
+          type = "soft";
+          value = "524288";
+        }
+        {
+          domain = "@wheel";
+          item = "nofile";
+          type = "hard";
+          value = "1048576";
+        }
+      ];
+
+      services =
+        let
+          ttyAudit = {
+            enable = true;
+            enablePattern = "*";
+          };
+        in
+        {
+          swaylock.text = "auth include login";
+          gtklock.text = "auth include login";
+
+          login = {
+            inherit ttyAudit;
+
+            setLoginUid = true;
+          };
+
+          sshd = {
+            inherit ttyAudit;
+
+            setLoginUid = true;
+          };
+
+          sudo = {
+            inherit ttyAudit;
+
+            setLoginUid = true;
+          };
+        };
+    };
+  };
+}
-- 
cgit v1.2.3