Nix

Elewrap is a minimalistic setuid wrapper program designed for secure privilege elevation, operating similarly to sudo but with a focus on simplicity and reduced attack surface. It statically compiles auth rules, allowing the definition of which users and commands can utilize elevated permissions, and provides a NixOS module for seamless integration and deployment. Notable features include the ability to authenticate target commands via SHA512 hash and fine-grained control over allowed users, groups, and environment variables.

`nix-secrets` is a lightweight secret management solution for NixOS that integrates seamlessly into the Nix module system, eliminating the need for external configuration files. It utilizes the age encryption format for secure secret storage and management, featuring templates, placeholders, and a simple CLI interface for key generation and secret editing. Notably, `nix-secrets` minimizes intermediate states and avoids public key leakage, offering a compact binary footprint compared to existing solutions like `sops-nix` or `agenix`.

The Nix Security Box is a curated collection of penetration testing and information security tools specifically designed for NixOS environments. It emphasizes a practical selection of actively maintained tools, combining both established and innovative options for security assessments, while allowing users to customize their toolset via Nix configuration files or shell environments. Notable features include modular imports for specific categories of tools and the ability to seamlessly create tailored development environments with desired functionalities.

Red-Flake Nix is a customized NixOS flake designed for penetration testing, red teaming, and CTFs, providing a pre-configured environment with essential tools and themes. Notable features include support for encrypted root on ZFS, a non-persistent root on tmpfs, systemd-boot with EFI, and integration of databases like PostgreSQL and Neo4j for Enhanced Metasploit and BloodHound capabilities. The setup is tailored with a customized KDE desktop and a variety of standalone tools, exploits, and wordlists for comprehensive cybersecurity operations.