From ed5bc2e30358f71c253ed985a503fac2c70ac152 Mon Sep 17 00:00:00 2001
From: hektor <hektor.misplon@pm.me>
Date: Mon, 26 Oct 2026 22:25:19 +0100
Subject: [PATCH] feat(lynis): declare 'lynis' module (with profile + skips)

---
 hosts/andromache/default.nix  |  1 +
 modules/hardening/default.nix | 14 ++++----
 modules/lynis/default.nix     | 62 +++++++++++++++++++++++++++++++++++
 3 files changed, 71 insertions(+), 6 deletions(-)
 create mode 100644 modules/lynis/default.nix

diff --git a/hosts/andromache/default.nix b/hosts/andromache/default.nix
index 40a3489..7112eb0 100644
--- a/hosts/andromache/default.nix
+++ b/hosts/andromache/default.nix
@@ -43,6 +43,7 @@ in
   };
   keyboard.enable = true;
   localization.enable = true;
+  lynis.enable = true;
   memory.zram.enable = true;
   my = {
     fonts.enable = true;
diff --git a/modules/hardening/default.nix b/modules/hardening/default.nix
index 50979da..055a720 100644
--- a/modules/hardening/default.nix
+++ b/modules/hardening/default.nix
@@ -6,6 +6,12 @@
 }:
 
 let
+  unusedProtocols = [
+    "dccp"
+    "sctp"
+    "rds"
+    "tipc"
+  ];
   wakeOnLan = lib.any (iface: iface.wakeOnLan.enable) (lib.attrValues config.networking.interfaces);
   randomMac = config.host.role == "laptop" && !wakeOnLan;
   desktop = {
@@ -79,12 +85,8 @@ in
         message = "no 'hardening.profile' for `${config.host.role}` host role";
       }
     ];
-    boot.blacklistedKernelModules = [
-      "dccp"
-      "sctp"
-      "rds"
-      "tipc"
-    ];
+    boot.blacklistedKernelModules = unusedProtocols;
+    boot.extraModprobeConfig = lib.concatMapStrings (m: "install ${m} /bin/false\n") unusedProtocols;
     hardware.bluetooth.settings.General = lib.mkIf config.hardware.bluetooth.enable {
       PairableTimeout = 30;
       DiscoverableTimeout = 30;
diff --git a/modules/lynis/default.nix b/modules/lynis/default.nix
new file mode 100644
index 0000000..e950bae
--- /dev/null
+++ b/modules/lynis/default.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  serverRoles = [
+    "server"
+    "embedded"
+  ];
+  server = lib.elem config.host.role serverRoles;
+  role = if server then "server" else "personal";
+  forwarding = lib.elem (config.boot.kernel.sysctl."net.ipv4.conf.all.forwarding" or false) [
+    true
+    1
+    "1"
+  ];
+in
+{
+  options.lynis = {
+    enable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+    };
+    skipTests = lib.mkOption {
+      default = [
+        "AUTH-9230"
+        "AUTH-9262"
+        "AUTH-9284"
+        "AUTH-9286"
+        "FILE-6310"
+        "FILE-6410"
+        "FINT-4350"
+        "KRNL-5830"
+        "NAME-4028"
+        "PKGS-7398"
+        "SSH-7408"
+        "TOOL-5002"
+      ]
+      ++ lib.optionals (!server) [
+        "ACCT-9622"
+        "ACCT-9626"
+        "ACCT-9628"
+        "HRDN-7222"
+        "HRDN-7230"
+        "LOGG-2154"
+        "USB-1000"
+      ]
+      ++ lib.optional forwarding "KRNL-6000:net.ipv4.conf.all.forwarding";
+      type = lib.types.listOf lib.types.str;
+    };
+  };
+
+  config = lib.mkIf config.lynis.enable {
+    environment.systemPackages = [ pkgs.lynis ];
+    environment.etc."lynis/custom.prf".text = lib.concatLines (
+      [ "machine-role=${role}" ] ++ map (t: "skip-test=${t}") config.lynis.skipTests
+    );
+  };
+}