lock down nix daemon

modules/common/neovim/config/misc.nix

@@ -7,11 +7,13 @@
     pkgs.vimPlugins.comment-nvim # Smart comment commands
     pkgs.vimPlugins.glow-nvim # Markdown preview popup
     pkgs.vimPlugins.nvim-colorizer-lua # Hex color previews
+    pkgs.vimPlugins.which-key-nvim # Keybind helper
   ];
 
   setup.Comment = { };
   setup.colorizer = { };
   setup.glow = { };
+  setup.which-key = { };
 
   vim.o = {
     termguicolors = true; # Set to truecolor
@@ -41,6 +43,10 @@
     relativenumber = true; # Relative numbers instead of absolute
   };
 
+  # For which-key-nvim
+  vim.o.timeout = true;
+  vim.o.timeoutlen = 300;
+
   # Better backup, swap and undo storage
   vim.o.backup = true; # Easier to recover and more secure
   vim.bo.swapfile = false; # Instead of swaps, create backups

modules/common/shell/nixpkgs.nix

@@ -73,6 +73,9 @@
       path = builtins.toString pkgs.path;
     };
 
+    # For security, only allow specific users
+    settings.allowed-users = [ "@wheel" config.user ];
+
   };
 
 }

modules/nixos/system/default.nix

@@ -28,6 +28,8 @@
         upper = "06:00";
       };
     };
+
+    # Create an email notification service for failed jobs
     systemd.services."notify-email@" =
       let address = "system@${config.mail.server}";
       in {
@@ -48,6 +50,8 @@
               ${address} < $TEMPFILE
         '';
       };
+
+    # Send an email whenever auto upgrade fails
     systemd.services.nixos-upgrade.onFailure =
       lib.mkIf config.systemd.services."notify-email@".enable
       [ "notify-email@%i.service" ];