skills.rest
kressnerd
kressnerdCOMMUNITY
Explore all skills by this author →
GitHub

Network & Security Administration

Configure and harden NixOS network security with firewall, SSH, VPN, TLS, and DNS.

2|Updated Jul 22, 2025
Search Tags:#vpn#firewall#nixos#tls#network-security#ssh-hardening
One-click install
npx skills add https://github.com/kressnerd/nix-config --skill network-security-administration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Network & Security Administration
Source: https://github.com/kressnerd/nix-config/tree/main/.roo/skills/network-security
Command: npx skills add https://github.com/kressnerd/nix-config --skill network-security-administration

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

NixOS-based deployments often suffer from insecure defaults and fragmented network configurations. This Skill provides a structured, end-to-end approach to firewall configuration, SSH hardening, VPN setup (WireGuard/Headscale), TLS/ACME certificate management, DNS, and system hardening to reduce attack surface and simplify secure operations.

Core Features & Use Cases

  • Comprehensive firewall configuration with support for iptables and nftables, including per-interface rules and logging.
  • SSH hardening for server and client components, with strong authentication and key management.
  • VPN capabilities via WireGuard and Headscale for secure site-to-site or remote access.
  • TLS/ACME certificate automation, including DNS-01 challenges and certificate management strategies.
  • DNS configuration, system hardening and monitoring to maintain compliance and security posture.
  • Real-world use case: securely connect multiple hosts across environments with automated configuration and verifiable hardening.

Quick Start

Run a baseline security hardening pass by auditing firewall rules, SSH configuration, VPN setup, TLS certificates, and DNS protection on a NixOS host.

Frequently Asked Questions about Network & Security Administration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I harden SSH and configure a firewall in NixOS?▼

Harden NixOS by configuring firewall rules using iptables or nftables and applying SSH hardening for strong authentication and key management. This reduces the attack surface across server and client components.

Can I set up WireGuard or Headscale VPN on NixOS for remote access?▼

Yes, you can configure VPN capabilities via WireGuard and Headscale on NixOS for secure site-to-site or remote access. This requires using NixOS modules and sops-managed secrets to safely set up connections.

What is the best way to automate TLS certificates with ACME on NixOS?▼

Automate TLS certificates on NixOS by configuring ACME certificate management with DNS-01 challenges. This approach streamlines certificate management strategies and maintains compliance across multiple hosts.

Do I need sops-managed secrets to configure network security in NixOS?▼

Yes, sops-managed secrets are required to securely handle sensitive data like VPN keys and TLS certificates during NixOS network security configuration. They work alongside NixOS modules to prevent misconfiguration.

How to prevent SSH lockout when testing NixOS firewall and network hardening changes?▼

Prevent SSH lockout during NixOS network hardening by following safe testing practices before applying firewall rule changes and SSH configuration updates. This ensures you maintain access while reducing the system attack surface.

Related Skills

Explore More Software Engineering Skills→
johnnymo87johnnymo87
4

Managing Secrets

Automate secret encryption, decryption, rotation, and deployment in NixOS workflows.

Community
Advanced
linardsblinardsb

attack-surface-audit

Regenerates and verifies an organization's attack surface across systems, hosts, and services.

Community
Advanced
DaRacciDaRacci
18

secrets

Manage encrypted secrets with sops-nix and age for NixOS configurations.

Community
Advanced
jtucker9jtucker9

hetzner-setup

Provision Hetzner Cloud servers with SSH hardening, Docker, Caddy, and backups.

Community
Advanced