feat(hecuba): switch to UEFI (and modularize)

flake.lock

@@ -226,6 +226,20 @@
         "type": "github"
       }
     },
+    "flake-compat_3": {
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "revCount": 69,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -248,6 +262,24 @@
       }
     },
     "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -417,6 +449,28 @@
         "type": "github"
       }
     },
+    "nix-mineral": {
+      "inputs": {
+        "flake-compat": "flake-compat_3",
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1792339378,
+        "narHash": "sha256-2GSp02yOdG9BSvb0c9SW1nsMnUpjR1/WBKskGz0D+8g=",
+        "owner": "cynicsketch",
+        "repo": "nix-mineral",
+        "rev": "bcd361bb18fccc4297d668aa5e0d5e4ebd4918ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cynicsketch",
+        "repo": "nix-mineral",
+        "type": "github"
+      }
+    },
     "nix-secrets": {
       "flake": false,
       "locked": {
@@ -503,6 +557,21 @@
         "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1777168982,
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1792210252,
@@ -639,6 +708,7 @@
         "git-hooks": "git-hooks",
         "hecuba-services": "hecuba-services",
         "home-manager": "home-manager",
+        "nix-mineral": "nix-mineral",
         "nix-secrets": "nix-secrets",
         "nixgl": "nixgl",
         "nixos-hardware": "nixos-hardware",
@@ -714,7 +784,7 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"

flake.nix

@@ -6,6 +6,10 @@
     nixos-hardware = {
       url = "github:NixOS/nixos-hardware/master";
     };
+    nix-mineral = {
+      url = "github:cynicsketch/nix-mineral";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     disko = {
       url = "github:nix-community/disko/latest";
       inputs.nixpkgs.follows = "nixpkgs";

hosts/andromache/default.nix

@@ -56,6 +56,7 @@ in
   desktop.ly.enable = true;
   docker.enable = true;
   k8s.enable = true;
+  hardening.enable = true;
   hcloud.enable = true;
   networking = {
     enable = true;

hosts/hecuba/default.nix

@@ -1,5 +1,6 @@
 {
   inputs,
+  lib,
   pkgs,
   config,
   ...
@@ -9,6 +10,8 @@
 
 let
   meta = import ./meta.nix;
+  bios = config.bootloader.firmware == "bios";
+  uefi = config.bootloader.firmware == "uefi";
 in
 {
   imports = [
@@ -23,7 +26,15 @@ in
 
   hardware.facter.reportPath = ./facter.json;
 
+  bootloader = {
+    enable = true;
+    firmware = "uefi";
+  };
   docker.enable = true;
+  hardening = {
+    enable = true;
+    profile = "server";
+  };
   secrets.enable = true;
   ssh.enable = true;
   tailscale.enable = true;
@@ -57,22 +68,56 @@ in
 
   networking.hostName = config.host.name;
 
-  fileSystems."/" = {
+  boot.loader.grub.device = lib.mkIf bios "/dev/sda";
-    device = "/dev/disk/by-label/nixos";
+  boot.loader.systemd-boot.bootCounting.enable = lib.mkIf uefi true;
-    fsType = "ext4";
+
+  fileSystems = lib.mkIf bios {
+    "/" = {
+      device = "/dev/disk/by-label/nixos";
+      fsType = "ext4";
+    };
+    "/boot" = {
+      device = "/dev/disk/by-label/boot";
+      fsType = "ext4";
+    };
   };
-  fileSystems."/boot" = {
+  swapDevices = lib.mkIf bios [
-    device = "/dev/disk/by-label/boot";
-    fsType = "ext4";
-  };
-  swapDevices = [
     {
       device = "/dev/disk/by-label/swap";
     }
   ];
 
-  boot.loader.grub.enable = true;
+  disko.devices.disk.main = lib.mkIf uefi {
-  boot.loader.grub.device = "/dev/sda";
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [ "umask=0077" ];
+          };
+        };
+        swap = {
+          size = "4G";
+          content.type = "swap";
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
 
   users.users = {
     root.hashedPassword = "!";
@@ -84,11 +129,7 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
-  nix.gc = {
+  nix.gc.options = "--delete-older-than 14d";
-    automatic = true;
-    dates = "weekly";
-    options = "-d";
-  };
 
   virtualisation.docker.autoPrune = {
     enable = true;

modules/bootloader/default.nix

@@ -1,17 +1,31 @@
 { lib, config, ... }:
 
 {
-  options.bootloader.enable = lib.mkOption {
+  options.bootloader = {
-    default = false;
+    enable = lib.mkOption {
-    type = lib.types.bool;
+      default = false;
-  };
+      type = lib.types.bool;
-
+    };
-  config = lib.mkIf config.bootloader.enable {
+    firmware = lib.mkOption {
-    boot = {
+      default = "uefi";
-      loader = {
+      type = lib.types.enum [
-        systemd-boot.enable = true;
+        "bios"
-        efi.canTouchEfiVariables = true;
+        "uefi"
-      };
+      ];
     };
   };
+
+  config = lib.mkIf config.bootloader.enable (
+    lib.mkMerge [
+      (lib.mkIf (config.bootloader.firmware == "uefi") {
+        boot.loader = {
+          systemd-boot.enable = true;
+          efi.canTouchEfiVariables = true;
+        };
+      })
+      (lib.mkIf (config.bootloader.firmware == "bios") {
+        boot.loader.grub.enable = true;
+      })
+    ]
+  );
 }

modules/hardening/default.nix

@@ -0,0 +1,105 @@
+{
+  inputs,
+  config,
+  lib,
+  ...
+}:
+
+let
+  wakeOnLan = lib.any (iface: iface.wakeOnLan.enable) (lib.attrValues config.networking.interfaces);
+  randomMac = config.host.role == "laptop" && !wakeOnLan;
+  profiles = {
+    workstation = {
+      preset = [
+        "compatibility"
+      ]
+      ++ lib.optional config.gaming.enable "performance"; # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
+      settings = {
+        debug.debugfs = true;
+        etc.harden-bluetooth = false;
+      };
+    };
+
+    server = {
+      preset = [
+        "compatibility"
+        "maximum" # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
+      ];
+      settings = {
+        debug.quiet-boot = false;
+        network = {
+          ipv6-tempaddr = false;
+          max-addresses = false;
+          neighbor-solicitations = false;
+          router-solicitations = false;
+        };
+        system = {
+          lower-address-mmap = false;
+          multilib = false;
+          yama = "admin-only";
+        };
+      };
+      extras = {
+        kernel.warn-panic = false;
+        system.secure-chrony = null;
+        network = {
+          tcp-window-scaling = true;
+        };
+      };
+    };
+  };
+in
+{
+  imports = [ inputs.nix-mineral.nixosModules.nix-mineral ];
+
+  options.hardening = {
+    enable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+    };
+    profile = lib.mkOption {
+      default = "workstation";
+      type = lib.types.enum [
+        "workstation"
+        "server"
+      ];
+    };
+  };
+
+  config = lib.mkIf config.hardening.enable {
+    boot.blacklistedKernelModules = [
+      "dccp"
+      "sctp"
+      "rds"
+      "tipc"
+    ];
+    networking.wireless.iwd.settings.General.AddressRandomization = lib.mkIf randomMac "network";
+    nix-mineral = lib.mkMerge [
+      {
+        enable = true;
+        filesystems.normal = {
+          "/tmp".enable = !config.boot.tmp.useTmpfs;
+          # only needed for FAT
+          "/boot".options.umask = lib.mkIf (
+            !lib.elem (config.fileSystems."/boot".fsType or null) [
+              "vfat"
+              "msdos"
+              "exfat"
+            ]
+          ) (lib.mkForce false);
+        };
+        settings = {
+          etc.harden-gitconfig = false;
+          kernel.cpu-mitigations = "smt-on";
+          network = {
+            ip-forwarding = config.virtualisation.docker.enable || config.services.k3s.enable;
+            random-mac = randomMac;
+            router-advertisements = "on";
+            tcp-sack = true;
+          };
+        };
+      }
+      profiles.${config.hardening.profile}
+    ];
+  };
+}