feat(lynis): declare 'lynis' module (with profile + skips)

modules/lynis/default.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  serverRoles = [
+    "server"
+    "embedded"
+  ];
+  server = lib.elem config.host.role serverRoles;
+  role = if server then "server" else "personal";
+  forwarding = lib.elem (config.boot.kernel.sysctl."net.ipv4.conf.all.forwarding" or false) [
+    true
+    1
+    "1"
+  ];
+in
+{
+  options.lynis = {
+    enable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+    };
+    skipTests = lib.mkOption {
+      default = [
+        "AUTH-9230"
+        "AUTH-9262"
+        "AUTH-9284"
+        "AUTH-9286"
+        "FILE-6310"
+        "FILE-6410"
+        "FINT-4350"
+        "KRNL-5830"
+        "NAME-4028"
+        "PKGS-7398"
+        "SSH-7408"
+        "TOOL-5002"
+      ]
+      ++ lib.optionals (!server) [
+        "ACCT-9622"
+        "ACCT-9626"
+        "ACCT-9628"
+        "HRDN-7222"
+        "HRDN-7230"
+        "KRNL-6000:kernel.modules_disabled"
+        "LOGG-2154"
+        "USB-1000"
+      ]
+      ++ lib.optional forwarding "KRNL-6000:net.ipv4.conf.all.forwarding";
+      type = lib.types.listOf lib.types.str;
+    };
+  };
+
+  config = lib.mkIf config.lynis.enable {
+    environment.systemPackages = [ pkgs.lynis ];
+    environment.etc."lynis/custom.prf".text = lib.concatLines (
+      [ "machine-role=${role}" ] ++ map (t: "skip-test=${t}") config.lynis.skipTests
+    );
+  };
+}