<commit_before>{ config, pkgs, lib, ... }: with lib;
let
  cloudDefault = mkOverride 900;

  fd-limit.soft = "262140";
  fd-limit.hard = "524280";
  core-limit = "1048576"; # one gigabyte
in
{
  # usually covered by things like security groups
  networking.firewall.enable = cloudDefault false;

  # likely not needed on a cloud box
  environment.noXlibs = cloudDefault true;

  time.timeZone = cloudDefault "UTC";
  i18n.supportedLocales = cloudDefault ["en_US.UTF-8/UTF-8"];

  nix.readOnlyStore = true;
  nix.trustedBinaryCaches = [ "http://hydra.nixos.org" ];

  services.openssh.enable = cloudDefault true;
  services.openssh.passwordAuthentication = cloudDefault false;
  services.openssh.challengeResponseAuthentication = cloudDefault false;

  security.pam.loginLimits = [ # login sessions only, not systemd services
    { domain = "*"; type = "hard"; item = "core"; value = core-limit; }
    { domain = "*"; type = "soft"; item = "core"; value = core-limit; }

    { domain = "*"; type = "soft"; item = "nofile"; value = fd-limit.soft; }<commit_msg>nixos/cloud-config: Disabling some more thing shouldn't hurt<commit_after>{ config, pkgs, lib, ... }: with lib;
let
  cloudDefault = mkOverride 900;

  fd-limit.soft = "262140";
  fd-limit.hard = "524280";
  core-limit = "1048576"; # one gigabyte
in
{
  # usually covered by things like security groups
  networking.firewall.enable = cloudDefault false;

  # likely not needed on a cloud box
  environment.noXlibs = cloudDefault true;

  time.timeZone = cloudDefault "UTC";
  i18n.supportedLocales = cloudDefault ["en_US.UTF-8/UTF-8"];

  nix.readOnlyStore = true;
  nix.trustedBinaryCaches = [ "http://hydra.nixos.org" ];

  services.nixosManual.enable = cloudDefault false
  security.polkit.enable = cloudDefault false
  services.udisks2.enable = cloudDefault false

  services.openssh.enable = cloudDefault true;
  services.openssh.passwordAuthentication = cloudDefault false;
  services.openssh.challengeResponseAuthentication = cloudDefault false;

  security.pam.loginLimits = [ # login sessions only, not systemd services
    { domain = "*"; type = "hard"; item = "core"; value = core-limit; }
    { domain = "*"; type = "soft"; item = "core"; value = core-limit; }

    { domain = "*"; type = "soft"; item = "nofile"; value = fd-limit.soft; }
{'fraction_non_alphanumeric': 0.13301559792027728, 'fraction_numerical': 0.02296360485268631, 'mean_word_length': 3.9549356223175964, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7449739', 'n_tokens_mistral': 781, 'n_tokens_neox': 715, 'n_words': 187}