Audit: nixfiles quality findings #57

New Issue

2026-07-06T15:28:01+01:00

lyrathorpe commented

2026-07-06 15:28:01 +01:00

Findings from a repository quality audit (code left unchanged; the doc fixes are in the docs PR). Grouped by severity.

High

Docker daemon over plain TCP 2375, no TLS/auth (hosts/RPi5/docker.nix) — root-equivalent, guarded only by an nftables source rule to 10.187.1.0/24. Documented as intentional, but the single largest fleet risk. Fix is the mTLS-on-2376 path (pairs with the Terraform Docker-mTLS work); never widen the subnet.

Medium

Hardcoded LAN values — 10.187.1.0/24 (hosts/RPi5/docker.nix:13) and 10.187.1.76 (home/shell.nix:338) duplicated with no shared source; consider a lib/net.nix constant.
Repo-path assumptions — $HOME/code/nixfiles (home/shell.nix) and $HOME/code (users/emmathorpe/renovate-review.nix:84) break if cloned elsewhere.
Hardcoded Windows path in a mkForce script — hosts/EDaaS/configuration.nix:61.
Placeholder hardware-configuration.nix committed for hosts/T400 and hosts/RPi5 — CI green does not mean bootable. Loud banners exist; keep them.

Low

Un-tracked pinned fetches — bat/btop Catppuccin themes fetched by rev/hash outside flake inputs (home/shell.nix); not Renovate-tracked, rot on upstream force-push. Prefer flake = false inputs (as kube-tmux does).
Redundant == true — modules/users.nix:32,35 (statix bool_comparison).
rec overuse — home/sway.nix:44.
Per-host firewall-enable repetition — factor into a shared module.
Stale in-code comments — modules/sway.nix:15, hosts/RPi5/configuration.nix:20 still reference system/modules/features.nix; the docs PR could not touch .nix, so fix in a code follow-up.

Not defects: mixed stateVersion values (intentional); tf-inspect/ is an unrelated nested scratch project.

Findings from a repository quality audit (code left unchanged; the doc fixes are in the docs PR). Grouped by severity. ### High - **Docker daemon over plain TCP 2375, no TLS/auth** (`hosts/RPi5/docker.nix`) — root-equivalent, guarded only by an nftables source rule to `10.187.1.0/24`. Documented as intentional, but the single largest fleet risk. Fix is the mTLS-on-2376 path (pairs with the Terraform Docker-mTLS work); never widen the subnet. ### Medium - **Hardcoded LAN values** — `10.187.1.0/24` (`hosts/RPi5/docker.nix:13`) and `10.187.1.76` (`home/shell.nix:338`) duplicated with no shared source; consider a `lib/net.nix` constant. - **Repo-path assumptions** — `$HOME/code/nixfiles` (`home/shell.nix`) and `$HOME/code` (`users/emmathorpe/renovate-review.nix:84`) break if cloned elsewhere. - **Hardcoded Windows path** in a `mkForce` script — `hosts/EDaaS/configuration.nix:61`. - **Placeholder `hardware-configuration.nix`** committed for `hosts/T400` and `hosts/RPi5` — CI green does not mean bootable. Loud banners exist; keep them. ### Low - **Un-tracked pinned fetches** — bat/btop Catppuccin themes fetched by rev/hash outside flake inputs (`home/shell.nix`); not Renovate-tracked, rot on upstream force-push. Prefer `flake = false` inputs (as `kube-tmux` does). - **Redundant `== true`** — `modules/users.nix:32,35` (statix `bool_comparison`). - **`rec` overuse** — `home/sway.nix:44`. - **Per-host firewall-enable repetition** — factor into a shared module. - **Stale in-code comments** — `modules/sway.nix:15`, `hosts/RPi5/configuration.nix:20` still reference `system/modules/features.nix`; the docs PR could not touch `.nix`, so fix in a code follow-up. Not defects: mixed `stateVersion` values (intentional); `tf-inspect/` is an unrelated nested scratch project.

lyrathorpe referenced this issue

2026-07-06 15:36:52 +01:00

chore(nix): statix bool_comparison + stale-path comment fixes #58

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lyrathorpe/nixfiles#57