feat(hardening): declare hardening module using 'nix-mineral'

modules/hardening/default.nix

@@ -0,0 +1,111 @@
+{
+  inputs,
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.hardening;
+  wakeOnLan = lib.any (iface: iface.wakeOnLan.enable) (lib.attrValues config.networking.interfaces);
+  randomMac = config.host.role == "laptop" && !wakeOnLan;
+  profiles = {
+    workstation = {
+      preset = [
+        "compatibility"
+      ]
+      ++ lib.optional config.gaming.enable "performance"; # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
+      settings = {
+        kernel.cpu-mitigations = "smt-on";
+        debug.debugfs = true;
+        etc = {
+          harden-bluetooth = false;
+          harden-gitconfig = false;
+        };
+        network = {
+          router-advertisements = "on";
+          tcp-sack = true;
+        };
+      };
+    };
+
+    server = {
+      preset = [
+        "compatibility"
+        "maximum" # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
+      ];
+      settings = {
+        etc = {
+          harden-gitconfig = false;
+        };
+        debug.quiet-boot = false;
+        kernel.cpu-mitigations = "smt-on";
+        network = {
+          ipv6-tempaddr = false;
+          max-addresses = false;
+          neighbor-solicitations = false;
+          router-advertisements = "on";
+          router-solicitations = false;
+          tcp-sack = true;
+        };
+        system = {
+          lower-address-mmap = false;
+          multilib = false;
+          yama = "admin-only";
+        };
+      };
+      extras = {
+        kernel.warn-panic = false;
+        system.secure-chrony = null;
+        network = {
+          tcp-window-scaling = true;
+        };
+      };
+    };
+  };
+in
+{
+  imports = [ inputs.nix-mineral.nixosModules.nix-mineral ];
+
+  options.hardening = {
+    enable = lib.mkEnableOption "hardening";
+    profile = lib.mkOption {
+      type = lib.types.enum [
+        "workstation"
+        "server"
+      ];
+      default = "workstation";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.blacklistedKernelModules = [
+      "dccp"
+      "sctp"
+      "rds"
+      "tipc"
+    ];
+    networking.wireless.iwd.settings.General.AddressRandomization = lib.mkIf randomMac "network";
+    nix-mineral = lib.mkMerge [
+      {
+        enable = true;
+        filesystems.normal = {
+          "/tmp".enable = !config.boot.tmp.useTmpfs;
+          # only needed for FAT
+          "/boot".options.umask = lib.mkIf (
+            !lib.elem (config.fileSystems."/boot".fsType or null) [
+              "vfat"
+              "msdos"
+              "exfat"
+            ]
+          ) (lib.mkForce false);
+        };
+        settings.network = {
+          ip-forwarding = config.virtualisation.docker.enable || config.services.k3s.enable;
+          random-mac = randomMac;
+        };
+      }
+      profiles.${cfg.profile}
+    ];
+  };
+}