From 32b231e07aff49ae770e9f9f2a93c54b78f738cc Mon Sep 17 00:00:00 2001
From: Anirudh Oppiliappan <anirudh@tangled.org>
Date: Wed, 29 Apr 2026 10:25:06 +0300
Subject: [PATCH] nix: add secureMode and timesyncd to vm

Signed-off-by: Anirudh Oppiliappan <anirudh@tangled.org>
---
 nix/vm.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nix/vm.nix b/nix/vm.nix
index f12debec..bef5a80b 100644
--- a/nix/vm.nix
+++ b/nix/vm.nix
@@ -103,6 +103,7 @@ in
         };
         # This is fine because any and all ports that are forwarded to host are explicitly marked above, we don't need a separate guest firewall
         networking.firewall.enable = false;
+        services.timesyncd.enable = lib.mkForce true;
         time.timeZone = "Europe/London";
         services.getty.autologinUser = "root";
         environment.systemPackages = with pkgs; [curl vim git sqlite litecli postgresql_14];
@@ -110,6 +111,7 @@ in
           enable = true;
           motd = "Welcome to the development knot!\n";
           server = {
+            secureMode = false;
             owner = envVar "TANGLED_VM_KNOT_OWNER";
             hostname = envVarOr "TANGLED_VM_KNOT_HOST" "localhost:6444";
             plcUrl = plcUrl;
@@ -155,6 +157,7 @@ in
         };
         services.tangled.knotmirror = {
           enable = true;
+          knotSSRF = false;
           listenAddr = "0.0.0.0:7000";
           metricsListenAddr = "0.0.0.0:7100";
           adminListenAddr = "0.0.0.0:7200";
-- 
2.51.2