feat(reference-manager): replace 'Zotero' with 'papis'

feat(lynis): declare 'lynis' module (with profile + skips)
feat(hecuba): switch to UEFI (and modularize)
2026-11-08 22:55:01 +01:00 · 2026-11-08 22:55:01 +01:00 · 2026-11-08 13:41:38 +01:00 · 2026-11-08 13:41:38 +01:00
12 changed files with 186 additions and 203 deletions
@@ -47,6 +47,7 @@
  nfc.enable = true;
  nvim.enable = true;
  pandoc.enable = true;
+  reference-manager.enable = true;
  secrets.enable = true;
  shell = {
    enable = true;
@@ -56,7 +57,6 @@
  deploy.enable = true;
  taskwarrior.enable = true;
  terminal.enable = true;
-  reference-manager.enable = true;

  programs = {
    home-manager.enable = true;
@@ -20,6 +20,11 @@
      default = config.home.username;
    };

+    readings.path = lib.mkOption {
+      default = "${config.home.homeDirectory}/doc/readings";
+      type = lib.types.str;
+    };
+
    nixgl.wrap = lib.mkOption {
      type = lib.types.functionTo lib.types.package;
      default = if config.lib ? nixGL then config.lib.nixGL.wrap else lib.id;
@@ -1,101 +0,0 @@
-{
-  "config": {
-    "options": {},
-    "preferences": {
-      "ascii": "",
-      "asciiBibLaTeX": false,
-      "asciiBibTeX": true,
-      "autoAbbrev": false,
-      "autoExport": "immediate",
-      "autoExportDelay": 5,
-      "autoExportIdleWait": 10,
-      "autoExportPathReplaceDiacritics": false,
-      "autoExportPathReplaceDirSep": "-",
-      "autoExportPathReplaceSpace": " ",
-      "automaticTags": true,
-      "auxImport": false,
-      "baseAttachmentPath": "/home/h/doc/readings",
-      "biblatexExtendedDateFormat": true,
-      "biblatexExtendedNameFormat": true,
-      "biblatexExtractEprint": true,
-      "biblatexUsePrefix": true,
-      "bibtexEditionOrdinal": false,
-      "bibtexParticleNoOp": false,
-      "bibtexURL": "off",
-      "cache": true,
-      "cacheDelete": false,
-      "charmap": "",
-      "chinese": false,
-      "chineseSplitName": true,
-      "citeCommand": "cite",
-      "citekeyCaseInsensitive": true,
-      "citekeyFold": true,
-      "citekeyFormat": "zotero.clean",
-      "citekeyFormatEditing": "zotero.clean",
-      "citekeySearch": false,
-      "citekeyUnsafeChars": "\\\"#%'(),={}~",
-      "csquotes": "",
-      "DOIandURL": "both",
-      "exportBibTeXStrings": "off",
-      "exportBraceProtection": true,
-      "exportSort": "citekey",
-      "exportTitleCase": true,
-      "extraMergeCitekeys": false,
-      "extraMergeCSL": false,
-      "extraMergeTeX": false,
-      "fillKeyAfter": 1,
-      "git": "config",
-      "import": true,
-      "importBibTeXStrings": true,
-      "importCaseProtection": "as-needed",
-      "importCitationKey": true,
-      "importDetectURLs": true,
-      "importExtra": true,
-      "importJabRefAbbreviations": true,
-      "importJabRefStrings": true,
-      "importNoteToExtra": "",
-      "importPlaceEvent": "inproceedings,conference,presentation,talk",
-      "importSentenceCase": "on+guess",
-      "importSentenceCaseQuoted": true,
-      "importUnknownTexCommand": "ignore",
-      "itemObserverDelay": 5,
-      "jabrefFormat": 0,
-      "japanese": false,
-      "keyScope": "global",
-      "language": "langid",
-      "logEvents": false,
-      "mapMath": "",
-      "mapText": "",
-      "packages": "",
-      "parseParticles": true,
-      "patchDates": "dateadded=dateAdded, date-added=dateAdded, datemodified=dateModified, date-modified=dateModified",
-      "platform": "lin",
-      "postscript": "",
-      "postscriptOverride": "",
-      "preferencesOverride": "",
-      "qualityReport": false,
-      "quickCopyEta": "",
-      "quickCopyMode": "citekeys",
-      "quickCopyOrgMode": "zotero",
-      "quickCopyPandocBrackets": false,
-      "quickCopySelectLink": "zotero",
-      "rawImports": false,
-      "rawLaTag": "#LaTeX",
-      "relativeFilePaths": false,
-      "remigrate": false,
-      "resetKeyOnChange": false,
-      "scrubDatabase": false,
-      "separatorList": "and",
-      "separatorNames": "and",
-      "skipFields": "",
-      "skipWords": "a,ab,aboard,about,above,across,after,against,al,along,amid,among,an,and,anti,around,as,at,before,behind,below,beneath,beside,besides,between,beyond,but,by,d,da,das,de,del,dell,dello,dei,degli,della,dell,delle,dem,den,der,des,despite,die,do,down,du,during,ein,eine,einem,einen,einer,eines,el,en,et,except,for,from,gli,i,il,in,inside,into,is,l,la,las,le,les,like,lo,los,near,nor,of,off,on,onto,or,over,past,per,plus,round,save,since,so,some,sur,than,the,through,to,toward,towards,un,una,unas,under,underneath,une,unlike,uno,unos,until,up,upon,versus,via,von,while,with,within,without,yet,zu,zum",
-      "startupProgress": "popup",
-      "strings": "",
-      "stringsOverride": "",
-      "testing": false,
-      "verbatimFields": "url,doi,file,pdf,ids,eprint,/^verb[a-z]$/,groups,/^citeulike-linkout-[0-9]+$/, /^bdsk-url-[0-9]+$/",
-      "warnBulkModify": 10,
-      "warnTitleCased": false
-    }
-  }
-}
@@ -1,67 +1,20 @@
+{ config, lib, ... }:
+
 {
-  config,
-  inputs,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  betterBibtex = pkgs.fetchzip (finalAttrs: {
-    pname = "zotero-better-bibtex";
-    version = "9.0.64";
-    url = "https://github.com/retorquere/zotero-better-bibtex/releases/download/v${finalAttrs.version}/zotero-better-bibtex-${finalAttrs.version}.xpi";
-    hash = "sha256-eu/lkWdW/wbehBjk/5ERnKxBob6yaoS4qsh75RaQx5A=";
-    extension = "zip";
-    stripRoot = false;
-  });
-
-  hasBrowser =
-    name:
-    lib.elem name [
-      config.browser.primary
-      config.browser.secondary
-    ];
-
-  zoteroConnector =
-    inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system}.zotero-connector;
-  zoteroAddonId = "zotero@chnm.gmu.edu";
-
-  connectorExtension = {
-    profiles.default.extensions.packages = [ zoteroConnector ];
-    policies.ExtensionSettings.${zoteroAddonId}.default_area = "navbar";
-  };
-in
-{
-  options.reference-manager.enable = lib.mkEnableOption "reference manager (Zotero)";
+  options.reference-manager.enable = lib.mkOption { default = false; };

  config = lib.mkIf config.reference-manager.enable {
-    home = {
-      packages = [ pkgs.zotero ];
-      file = {
-        ".zotero/bbt.json".source = ./bbt.json;
-        ".zotero/zotero/profiles.ini".text = lib.generators.toINI { } {
-          General = {
-            StartWithLastProfile = 1;
-            Version = 2;
-          };
-          Profile0 = {
-            Name = "default";
-            IsRelative = 1;
-            Path = "default";
-            Default = 1;
-          };
-        };
-
-        ".zotero/zotero/default/extensions/better-bibtex@iris-advies.com".source = betterBibtex;
-        ".zotero/zotero/default/user.js".text = ''
-          user_pref("extensions.startupScanScopes", 1);
-          user_pref("extensions.autoDisableScopes", 14);
-        '';
+    programs.papis = {
+      enable = true;
+      libraries.papers = {
+        isDefault = true;
+        settings.dir = "${config.readings.path}/papis";
+      };
+      settings = {
+        unique-document-keys = ''["ref"]'';
+        bibtex-ignore-keys = ''["abstract", "note", "csl_type", "collections", "tags", "files"]'';
+        add-folder-name = "{doc[ref]}";
      };
    };
-
-    programs.firefox = lib.mkIf (hasBrowser "firefox") connectorExtension;
-    programs.librewolf = lib.mkIf (hasBrowser "librewolf") connectorExtension;
  };
 }
@@ -24,7 +24,11 @@ in

  inherit (meta) host;

-  hardware.facter.reportPath = ./facter.json;
+  hardware = {
+    facter.reportPath = ./facter.json;
+    cpu.intel.updateMicrocode = true;
+    hackrf.enable = true;
+  };

  "ai-tools".enable = true;
  anki.enable = true;
@@ -43,6 +47,7 @@ in
  };
  keyboard.enable = true;
  localization.enable = true;
+  lynis.enable = true;
  memory.zram.enable = true;
  my = {
    fonts.enable = true;
@@ -77,15 +82,12 @@ in
  };
  ssh.enable = true;
  storage.enable = true;
-  syncthing = {
+  readings = {
    enable = true;
-    folders.readings = {
-      path = "/home/${config.host.username}/doc/readings";
-      devices = [
-        "astyanax"
-        "boox"
-      ];
-    };
+    peers = [
+      "astyanax"
+      "boox"
+    ];
  };
  tailscale.enable = true;
  taskwarrior.enable = true;
@@ -112,8 +114,6 @@ in
    };
  };

-  hardware.cpu.intel.updateMicrocode = true;
-
  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];

  services.locate = {
@@ -40,8 +40,10 @@ in
      model = "arc-140t";
    };
  };
+  hardening.enable = true;
  keyboard.enable = true;
  localization.enable = true;
+  lynis.enable = true;
  memory = {
    oom.enable = true;
    zram.enable = true;
@@ -60,15 +62,12 @@ in
  secrets.enable = true;
  ssh.enable = true;
  storage.enable = true;
-  syncthing = {
+  readings = {
    enable = true;
-    folders.readings = {
-      path = "/home/${config.host.username}/doc/readings";
-      devices = [
-        "andromache"
-        "boox"
-      ];
-    };
+    peers = [
+      "andromache"
+      "boox"
+    ];
  };
  taskwarrior.enable = true;
  wol.wakes = [ "andromache" ];
@@ -14,6 +14,7 @@ in

  inherit (meta) host;

+  lynis.enable = true;
  ssh.enable = true;
  tailscale.enable = true;
  wol.wakes = [ "andromache" ];
@@ -14,6 +14,7 @@ in

  inherit (meta) host;

+  lynis.enable = true;
  ssh.enable = true;
  tailscale.enable = true;

@@ -31,10 +31,8 @@ in
    firmware = "uefi";
  };
  docker.enable = true;
-  hardening = {
-    enable = true;
-    profile = "server";
-  };
+  hardening.enable = true;
+  lynis.enable = true;
  secrets.enable = true;
  ssh.enable = true;
  tailscale.enable = true;
@@ -6,18 +6,33 @@
 }:

 let
+  unusedProtocols = [
+    "dccp"
+    "sctp"
+    "rds"
+    "tipc"
+  ];
  wakeOnLan = lib.any (iface: iface.wakeOnLan.enable) (lib.attrValues config.networking.interfaces);
  randomMac = config.host.role == "laptop" && !wakeOnLan;
+  desktop = {
+    preset = [
+      "compatibility"
+    ]
+    ++ lib.optional config.gaming.enable "performance"; # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
+    settings = {
+      debug.debugfs = true;
+      etc.harden-bluetooth = false;
+    };
+  };
  profiles = {
-    workstation = {
+    inherit desktop;
+
+    laptop = lib.recursiveUpdate desktop {
      preset = [
        "compatibility"
-      ]
-      ++ lib.optional config.gaming.enable "performance"; # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
-      settings = {
-        debug.debugfs = true;
-        etc.harden-bluetooth = false;
-      };
+        "performance"
+      ];
+      settings.kernel.iommu-passthrough = false;
    };

    server = {
@@ -58,21 +73,25 @@ in
      type = lib.types.bool;
    };
    profile = lib.mkOption {
-      default = "workstation";
-      type = lib.types.enum [
-        "workstation"
-        "server"
-      ];
+      default = if profiles ? ${config.host.role} then config.host.role else null;
+      type = lib.types.nullOr (lib.types.enum (lib.attrNames profiles));
    };
  };

  config = lib.mkIf config.hardening.enable {
-    boot.blacklistedKernelModules = [
-      "dccp"
-      "sctp"
-      "rds"
-      "tipc"
+    assertions = [
+      {
+        assertion = config.hardening.profile != null;
+        message = "no 'hardening.profile' for `${config.host.role}` host role";
+      }
    ];
+    boot.blacklistedKernelModules = unusedProtocols;
+    boot.extraModprobeConfig = lib.concatMapStrings (m: "install ${m} /bin/false\n") unusedProtocols;
+    hardware.bluetooth.settings.General = lib.mkIf config.hardware.bluetooth.enable {
+      PairableTimeout = 30;
+      DiscoverableTimeout = 30;
+      TemporaryTimeout = 0;
+    };
    networking.wireless.iwd.settings.General.AddressRandomization = lib.mkIf randomMac "network";
    nix-mineral = lib.mkMerge [
      {
@@ -99,7 +118,7 @@ in
          };
        };
      }
-      profiles.${config.hardening.profile}
+      (lib.optionalAttrs (config.hardening.profile != null) profiles.${config.hardening.profile})
    ];
  };
 }
@@ -0,0 +1,63 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  serverRoles = [
+    "server"
+    "embedded"
+  ];
+  server = lib.elem config.host.role serverRoles;
+  role = if server then "server" else "personal";
+  forwarding = lib.elem (config.boot.kernel.sysctl."net.ipv4.conf.all.forwarding" or false) [
+    true
+    1
+    "1"
+  ];
+in
+{
+  options.lynis = {
+    enable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+    };
+    skipTests = lib.mkOption {
+      default = [
+        "AUTH-9230"
+        "AUTH-9262"
+        "AUTH-9284"
+        "AUTH-9286"
+        "FILE-6310"
+        "FILE-6410"
+        "FINT-4350"
+        "KRNL-5830"
+        "NAME-4028"
+        "PKGS-7398"
+        "SSH-7408"
+        "TOOL-5002"
+      ]
+      ++ lib.optionals (!server) [
+        "ACCT-9622"
+        "ACCT-9626"
+        "ACCT-9628"
+        "HRDN-7222"
+        "HRDN-7230"
+        "KRNL-6000:kernel.modules_disabled"
+        "LOGG-2154"
+        "USB-1000"
+      ]
+      ++ lib.optional forwarding "KRNL-6000:net.ipv4.conf.all.forwarding";
+      type = lib.types.listOf lib.types.str;
+    };
+  };
+
+  config = lib.mkIf config.lynis.enable {
+    environment.systemPackages = [ pkgs.lynis ];
+    environment.etc."lynis/custom.prf".text = lib.concatLines (
+      [ "machine-role=${role}" ] ++ map (t: "skip-test=${t}") config.lynis.skipTests
+    );
+  };
+}
@@ -0,0 +1,45 @@
+{ config, lib, ... }:
+
+let
+  inherit (config.host) username;
+  home = config.users.users.${username}.home;
+  devices = builtins.attrNames (import ../syncthing/devices.nix);
+in
+{
+  options.readings = {
+    enable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+    };
+    path = lib.mkOption {
+      default = "${home}/doc/readings";
+      type = lib.types.str;
+    };
+    peers = lib.mkOption {
+      type = lib.types.nonEmptyListOf (lib.types.enum devices);
+    };
+  };
+
+  config = lib.mkIf config.readings.enable {
+    assertions = [
+      {
+        assertion = !builtins.elem config.host.name config.readings.peers;
+        message = "'readings.peers' for ${config.host.name} should not include '${config.host.name}'.";
+      }
+    ];
+
+    syncthing = {
+      enable = true;
+      folders.readings = {
+        inherit (config.readings) path;
+        devices = config.readings.peers;
+      };
+    };
+
+    home-manager.sharedModules = [
+      {
+        readings.path = lib.mkDefault config.readings.path;
+      }
+    ];
+  };
+}
Author	SHA1	Message	Date
hektor	5c587dc5a7	feat(reference-manager): replace 'Zotero' with 'papis' check / lint (push) Successful in 6s Details	2026-11-08 22:55:01 +01:00
hektor	fce7a277a7	feat(lynis): declare 'lynis' module (with profile + skips)	2026-11-08 22:55:01 +01:00
hektor	21e5b62dfa	feat(hecuba): switch to UEFI (and modularize) check / lint (push) Successful in 9s Details	2026-11-08 13:41:38 +01:00
hektor	e794e6c0e2	feat(hardening): declare hardening module using 'nix-mineral'	2026-11-08 13:41:38 +01:00