I wonder if it makes sense to break my system config into more modules and get in the habit of only enabling modules when I'm using them as a way of reducing the attack surface for my system.

I kinda do this anyway just to keep the number of entries in the application menu down, but I wonder if there's any real security benefit.

#NixOS

Reply to this note

Please Login to reply.

Discussion

for sure, I have a bunch of switches that turn off many modules and firewall settings at once to create a layered config for the type of system I’m on. The programmability of nixos configs is super poweful.

Or Qubes

For stuff I don't use often but want to keep handy and configured I just make a directory with a dev shell.