base: blacklist modules

modules/defaults/base/default.nix

@@ -1,7 +1,8 @@
-# This is seperate so we have 1:1 what we have in ansible in here
+# This is seperate so we have 1:1 what we have in ansible base role in here
 
 {
   imports = [
+    ./modules.nix
     ./screen.nix
     ./sshd.nix
     ./sysctl.nix

modules/defaults/base/modules.nix

@@ -0,0 +1,34 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  net = [
+    "dccp"
+    "sctp"
+    "rds"
+    "tipc"
+  ];
+  fs = [
+    "cramfs"
+    "freevxfs"
+    "hfs"
+    "hfsplus"
+    "jffs2"
+  ];
+  misc = [
+    "bluetooth"
+    "firewire-core"
+    "n_hdlc"
+    "net-pf-31"
+    "soundcore"
+    "thunderbolt"
+    "usb-midi"
+  ];
+in
+{
+  environment.etc."modprobe.d/disablemod.conf".text = concatStringsSep "\n"
+    (map (module: "install ${module} ${pkgs.coreutils}/bin/true")
+      (net ++ fs ++ misc)
+    );
+}