feat(hecuba): switch to UEFI (and modularize)

hosts/astyanax/default.nix

@@ -40,6 +40,7 @@ in
       model = "arc-140t";
     };
   };
+  hardening.enable = true;
   keyboard.enable = true;
   localization.enable = true;
   memory = {

hosts/hecuba/default.nix

@@ -31,10 +31,7 @@ in
     firmware = "uefi";
   };
   docker.enable = true;
-  hardening = {
+  hardening.enable = true;
-    enable = true;
-    profile = "server";
-  };
   secrets.enable = true;
   ssh.enable = true;
   tailscale.enable = true;

modules/hardening/default.nix

@@ -8,16 +8,25 @@
 let
   wakeOnLan = lib.any (iface: iface.wakeOnLan.enable) (lib.attrValues config.networking.interfaces);
   randomMac = config.host.role == "laptop" && !wakeOnLan;
+  desktop = {
+    preset = [
+      "compatibility"
+    ]
+    ++ lib.optional config.gaming.enable "performance"; # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
+    settings = {
+      debug.debugfs = true;
+      etc.harden-bluetooth = false;
+    };
+  };
   profiles = {
-    workstation = {
+    inherit desktop;
+
+    laptop = lib.recursiveUpdate desktop {
       preset = [
         "compatibility"
-      ]
+        "performance"
-      ++ lib.optional config.gaming.enable "performance"; # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
+      ];
-      settings = {
+      settings.kernel.iommu-passthrough = false;
-        debug.debugfs = true;
-        etc.harden-bluetooth = false;
-      };
     };
 
     server = {
@@ -58,21 +67,29 @@ in
       type = lib.types.bool;
     };
     profile = lib.mkOption {
-      default = "workstation";
+      default = if profiles ? ${config.host.role} then config.host.role else null;
-      type = lib.types.enum [
+      type = lib.types.nullOr (lib.types.enum (lib.attrNames profiles));
-        "workstation"
-        "server"
-      ];
     };
   };
 
   config = lib.mkIf config.hardening.enable {
+    assertions = [
+      {
+        assertion = config.hardening.profile != null;
+        message = "no 'hardening.profile' for `${config.host.role}` host role";
+      }
+    ];
     boot.blacklistedKernelModules = [
       "dccp"
       "sctp"
       "rds"
       "tipc"
     ];
+    hardware.bluetooth.settings.General = lib.mkIf config.hardware.bluetooth.enable {
+      PairableTimeout = 30;
+      DiscoverableTimeout = 30;
+      TemporaryTimeout = 0;
+    };
     networking.wireless.iwd.settings.General.AddressRandomization = lib.mkIf randomMac "network";
     nix-mineral = lib.mkMerge [
       {
@@ -99,7 +116,7 @@ in
           };
         };
       }
-      profiles.${config.hardening.profile}
+      (lib.optionalAttrs (config.hardening.profile != null) profiles.${config.hardening.profile})
     ];
   };
 }