feat(hecuba): switch to UEFI (and modularize)

home/hosts/astyanax/default.nix

@@ -47,7 +47,6 @@
   nfc.enable = true;
   nvim.enable = true;
   pandoc.enable = true;
-  reference-manager.enable = true;
   secrets.enable = true;
   shell = {
     enable = true;
@@ -57,6 +56,7 @@
   deploy.enable = true;
   taskwarrior.enable = true;
   terminal.enable = true;
+  reference-manager.enable = true;
 
   programs = {
     home-manager.enable = true;

home/modules/default.nix

@@ -20,11 +20,6 @@
       default = config.home.username;
     };
 
-    readings.path = lib.mkOption {
-      default = "${config.home.homeDirectory}/doc/readings";
-      type = lib.types.str;
-    };
-
     nixgl.wrap = lib.mkOption {
       type = lib.types.functionTo lib.types.package;
       default = if config.lib ? nixGL then config.lib.nixGL.wrap else lib.id;

home/modules/reference-manager/bbt.json

@@ -0,0 +1,101 @@
+{
+  "config": {
+    "options": {},
+    "preferences": {
+      "ascii": "",
+      "asciiBibLaTeX": false,
+      "asciiBibTeX": true,
+      "autoAbbrev": false,
+      "autoExport": "immediate",
+      "autoExportDelay": 5,
+      "autoExportIdleWait": 10,
+      "autoExportPathReplaceDiacritics": false,
+      "autoExportPathReplaceDirSep": "-",
+      "autoExportPathReplaceSpace": " ",
+      "automaticTags": true,
+      "auxImport": false,
+      "baseAttachmentPath": "/home/h/doc/readings",
+      "biblatexExtendedDateFormat": true,
+      "biblatexExtendedNameFormat": true,
+      "biblatexExtractEprint": true,
+      "biblatexUsePrefix": true,
+      "bibtexEditionOrdinal": false,
+      "bibtexParticleNoOp": false,
+      "bibtexURL": "off",
+      "cache": true,
+      "cacheDelete": false,
+      "charmap": "",
+      "chinese": false,
+      "chineseSplitName": true,
+      "citeCommand": "cite",
+      "citekeyCaseInsensitive": true,
+      "citekeyFold": true,
+      "citekeyFormat": "zotero.clean",
+      "citekeyFormatEditing": "zotero.clean",
+      "citekeySearch": false,
+      "citekeyUnsafeChars": "\\\"#%'(),={}~",
+      "csquotes": "",
+      "DOIandURL": "both",
+      "exportBibTeXStrings": "off",
+      "exportBraceProtection": true,
+      "exportSort": "citekey",
+      "exportTitleCase": true,
+      "extraMergeCitekeys": false,
+      "extraMergeCSL": false,
+      "extraMergeTeX": false,
+      "fillKeyAfter": 1,
+      "git": "config",
+      "import": true,
+      "importBibTeXStrings": true,
+      "importCaseProtection": "as-needed",
+      "importCitationKey": true,
+      "importDetectURLs": true,
+      "importExtra": true,
+      "importJabRefAbbreviations": true,
+      "importJabRefStrings": true,
+      "importNoteToExtra": "",
+      "importPlaceEvent": "inproceedings,conference,presentation,talk",
+      "importSentenceCase": "on+guess",
+      "importSentenceCaseQuoted": true,
+      "importUnknownTexCommand": "ignore",
+      "itemObserverDelay": 5,
+      "jabrefFormat": 0,
+      "japanese": false,
+      "keyScope": "global",
+      "language": "langid",
+      "logEvents": false,
+      "mapMath": "",
+      "mapText": "",
+      "packages": "",
+      "parseParticles": true,
+      "patchDates": "dateadded=dateAdded, date-added=dateAdded, datemodified=dateModified, date-modified=dateModified",
+      "platform": "lin",
+      "postscript": "",
+      "postscriptOverride": "",
+      "preferencesOverride": "",
+      "qualityReport": false,
+      "quickCopyEta": "",
+      "quickCopyMode": "citekeys",
+      "quickCopyOrgMode": "zotero",
+      "quickCopyPandocBrackets": false,
+      "quickCopySelectLink": "zotero",
+      "rawImports": false,
+      "rawLaTag": "#LaTeX",
+      "relativeFilePaths": false,
+      "remigrate": false,
+      "resetKeyOnChange": false,
+      "scrubDatabase": false,
+      "separatorList": "and",
+      "separatorNames": "and",
+      "skipFields": "",
+      "skipWords": "a,ab,aboard,about,above,across,after,against,al,along,amid,among,an,and,anti,around,as,at,before,behind,below,beneath,beside,besides,between,beyond,but,by,d,da,das,de,del,dell,dello,dei,degli,della,dell,delle,dem,den,der,des,despite,die,do,down,du,during,ein,eine,einem,einen,einer,eines,el,en,et,except,for,from,gli,i,il,in,inside,into,is,l,la,las,le,les,like,lo,los,near,nor,of,off,on,onto,or,over,past,per,plus,round,save,since,so,some,sur,than,the,through,to,toward,towards,un,una,unas,under,underneath,une,unlike,uno,unos,until,up,upon,versus,via,von,while,with,within,without,yet,zu,zum",
+      "startupProgress": "popup",
+      "strings": "",
+      "stringsOverride": "",
+      "testing": false,
+      "verbatimFields": "url,doi,file,pdf,ids,eprint,/^verb[a-z]$/,groups,/^citeulike-linkout-[0-9]+$/, /^bdsk-url-[0-9]+$/",
+      "warnBulkModify": 10,
+      "warnTitleCased": false
+    }
+  }
+}

home/modules/reference-manager/default.nix

@@ -1,20 +1,67 @@
-{ config, lib, ... }:
-
 {
-  options.reference-manager.enable = lib.mkOption { default = false; };
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  betterBibtex = pkgs.fetchzip (finalAttrs: {
+    pname = "zotero-better-bibtex";
+    version = "9.0.64";
+    url = "https://github.com/retorquere/zotero-better-bibtex/releases/download/v${finalAttrs.version}/zotero-better-bibtex-${finalAttrs.version}.xpi";
+    hash = "sha256-eu/lkWdW/wbehBjk/5ERnKxBob6yaoS4qsh75RaQx5A=";
+    extension = "zip";
+    stripRoot = false;
+  });
+
+  hasBrowser =
+    name:
+    lib.elem name [
+      config.browser.primary
+      config.browser.secondary
+    ];
+
+  zoteroConnector =
+    inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system}.zotero-connector;
+  zoteroAddonId = "zotero@chnm.gmu.edu";
+
+  connectorExtension = {
+    profiles.default.extensions.packages = [ zoteroConnector ];
+    policies.ExtensionSettings.${zoteroAddonId}.default_area = "navbar";
+  };
+in
+{
+  options.reference-manager.enable = lib.mkEnableOption "reference manager (Zotero)";
 
   config = lib.mkIf config.reference-manager.enable {
-    programs.papis = {
+    home = {
-      enable = true;
+      packages = [ pkgs.zotero ];
-      libraries.papers = {
+      file = {
-        isDefault = true;
+        ".zotero/bbt.json".source = ./bbt.json;
-        settings.dir = "${config.readings.path}/papis";
+        ".zotero/zotero/profiles.ini".text = lib.generators.toINI { } {
+          General = {
+            StartWithLastProfile = 1;
+            Version = 2;
           };
-      settings = {
+          Profile0 = {
-        unique-document-keys = ''["ref"]'';
+            Name = "default";
-        bibtex-ignore-keys = ''["abstract", "note", "csl_type", "collections", "tags", "files"]'';
+            IsRelative = 1;
-        add-folder-name = "{doc[ref]}";
+            Path = "default";
+            Default = 1;
           };
         };
+
+        ".zotero/zotero/default/extensions/better-bibtex@iris-advies.com".source = betterBibtex;
+        ".zotero/zotero/default/user.js".text = ''
+          user_pref("extensions.startupScanScopes", 1);
+          user_pref("extensions.autoDisableScopes", 14);
+        '';
+      };
+    };
+
+    programs.firefox = lib.mkIf (hasBrowser "firefox") connectorExtension;
+    programs.librewolf = lib.mkIf (hasBrowser "librewolf") connectorExtension;
   };
 }

hosts/andromache/default.nix

@@ -24,11 +24,7 @@ in
 
   inherit (meta) host;
 
-  hardware = {
+  hardware.facter.reportPath = ./facter.json;
-    facter.reportPath = ./facter.json;
-    cpu.intel.updateMicrocode = true;
-    hackrf.enable = true;
-  };
 
   "ai-tools".enable = true;
   anki.enable = true;
@@ -47,7 +43,6 @@ in
   };
   keyboard.enable = true;
   localization.enable = true;
-  lynis.enable = true;
   memory.zram.enable = true;
   my = {
     fonts.enable = true;
@@ -82,13 +77,16 @@ in
   };
   ssh.enable = true;
   storage.enable = true;
-  readings = {
+  syncthing = {
     enable = true;
-    peers = [
+    folders.readings = {
+      path = "/home/${config.host.username}/doc/readings";
+      devices = [
         "astyanax"
         "boox"
       ];
     };
+  };
   tailscale.enable = true;
   taskwarrior.enable = true;
   wol.interfaces.eno1.macAddress = "02:68:b3:29:da:98";
@@ -114,6 +112,8 @@ in
     };
   };
 
+  hardware.cpu.intel.updateMicrocode = true;
+
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
   services.locate = {

hosts/astyanax/default.nix

@@ -40,10 +40,8 @@ in
       model = "arc-140t";
     };
   };
-  hardening.enable = true;
   keyboard.enable = true;
   localization.enable = true;
-  lynis.enable = true;
   memory = {
     oom.enable = true;
     zram.enable = true;
@@ -62,13 +60,16 @@ in
   secrets.enable = true;
   ssh.enable = true;
   storage.enable = true;
-  readings = {
+  syncthing = {
     enable = true;
-    peers = [
+    folders.readings = {
+      path = "/home/${config.host.username}/doc/readings";
+      devices = [
         "andromache"
         "boox"
       ];
     };
+  };
   taskwarrior.enable = true;
   wol.wakes = [ "andromache" ];
   zfs.enable = true;

hosts/eetion-02/default.nix

@@ -14,7 +14,6 @@ in
 
   inherit (meta) host;
 
-  lynis.enable = true;
   ssh.enable = true;
   tailscale.enable = true;
   wol.wakes = [ "andromache" ];

hosts/eetion/default.nix

@@ -14,7 +14,6 @@ in
 
   inherit (meta) host;
 
-  lynis.enable = true;
   ssh.enable = true;
   tailscale.enable = true;
 

hosts/hecuba/default.nix

@@ -1,6 +1,5 @@
 {
   inputs,
-  lib,
   pkgs,
   config,
   ...
@@ -30,9 +29,12 @@ in
     enable = true;
     firmware = "uefi";
   };
+  comin.enable = true;
   docker.enable = true;
-  hardening.enable = true;
+  hardening = {
-  lynis.enable = true;
+    enable = true;
+    profile = "server";
+  };
   secrets.enable = true;
   ssh.enable = true;
   tailscale.enable = true;

modules/hardening/default.nix

@@ -6,15 +6,10 @@
 }:
 
 let
-  unusedProtocols = [
-    "dccp"
-    "sctp"
-    "rds"
-    "tipc"
-  ];
   wakeOnLan = lib.any (iface: iface.wakeOnLan.enable) (lib.attrValues config.networking.interfaces);
   randomMac = config.host.role == "laptop" && !wakeOnLan;
-  desktop = {
+  profiles = {
+    workstation = {
       preset = [
         "compatibility"
       ]
@@ -24,16 +19,6 @@ let
         etc.harden-bluetooth = false;
       };
     };
-  profiles = {
-    inherit desktop;
-
-    laptop = lib.recursiveUpdate desktop {
-      preset = [
-        "compatibility"
-        "performance"
-      ];
-      settings.kernel.iommu-passthrough = false;
-    };
 
     server = {
       preset = [
@@ -73,25 +58,21 @@ in
       type = lib.types.bool;
     };
     profile = lib.mkOption {
-      default = if profiles ? ${config.host.role} then config.host.role else null;
+      default = "workstation";
-      type = lib.types.nullOr (lib.types.enum (lib.attrNames profiles));
+      type = lib.types.enum [
+        "workstation"
+        "server"
+      ];
     };
   };
 
   config = lib.mkIf config.hardening.enable {
-    assertions = [
+    boot.blacklistedKernelModules = [
-      {
+      "dccp"
-        assertion = config.hardening.profile != null;
+      "sctp"
-        message = "no 'hardening.profile' for `${config.host.role}` host role";
+      "rds"
-      }
+      "tipc"
     ];
-    boot.blacklistedKernelModules = unusedProtocols;
-    boot.extraModprobeConfig = lib.concatMapStrings (m: "install ${m} /bin/false\n") unusedProtocols;
-    hardware.bluetooth.settings.General = lib.mkIf config.hardware.bluetooth.enable {
-      PairableTimeout = 30;
-      DiscoverableTimeout = 30;
-      TemporaryTimeout = 0;
-    };
     networking.wireless.iwd.settings.General.AddressRandomization = lib.mkIf randomMac "network";
     nix-mineral = lib.mkMerge [
       {
@@ -118,7 +99,7 @@ in
           };
         };
       }
-      (lib.optionalAttrs (config.hardening.profile != null) profiles.${config.hardening.profile})
+      profiles.${config.hardening.profile}
     ];
   };
 }

modules/lynis/default.nix

@@ -1,63 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-let
-  serverRoles = [
-    "server"
-    "embedded"
-  ];
-  server = lib.elem config.host.role serverRoles;
-  role = if server then "server" else "personal";
-  forwarding = lib.elem (config.boot.kernel.sysctl."net.ipv4.conf.all.forwarding" or false) [
-    true
-    1
-    "1"
-  ];
-in
-{
-  options.lynis = {
-    enable = lib.mkOption {
-      default = false;
-      type = lib.types.bool;
-    };
-    skipTests = lib.mkOption {
-      default = [
-        "AUTH-9230"
-        "AUTH-9262"
-        "AUTH-9284"
-        "AUTH-9286"
-        "FILE-6310"
-        "FILE-6410"
-        "FINT-4350"
-        "KRNL-5830"
-        "NAME-4028"
-        "PKGS-7398"
-        "SSH-7408"
-        "TOOL-5002"
-      ]
-      ++ lib.optionals (!server) [
-        "ACCT-9622"
-        "ACCT-9626"
-        "ACCT-9628"
-        "HRDN-7222"
-        "HRDN-7230"
-        "KRNL-6000:kernel.modules_disabled"
-        "LOGG-2154"
-        "USB-1000"
-      ]
-      ++ lib.optional forwarding "KRNL-6000:net.ipv4.conf.all.forwarding";
-      type = lib.types.listOf lib.types.str;
-    };
-  };
-
-  config = lib.mkIf config.lynis.enable {
-    environment.systemPackages = [ pkgs.lynis ];
-    environment.etc."lynis/custom.prf".text = lib.concatLines (
-      [ "machine-role=${role}" ] ++ map (t: "skip-test=${t}") config.lynis.skipTests
-    );
-  };
-}

modules/readings/default.nix

@@ -1,45 +0,0 @@
-{ config, lib, ... }:
-
-let
-  inherit (config.host) username;
-  home = config.users.users.${username}.home;
-  devices = builtins.attrNames (import ../syncthing/devices.nix);
-in
-{
-  options.readings = {
-    enable = lib.mkOption {
-      default = false;
-      type = lib.types.bool;
-    };
-    path = lib.mkOption {
-      default = "${home}/doc/readings";
-      type = lib.types.str;
-    };
-    peers = lib.mkOption {
-      type = lib.types.nonEmptyListOf (lib.types.enum devices);
-    };
-  };
-
-  config = lib.mkIf config.readings.enable {
-    assertions = [
-      {
-        assertion = !builtins.elem config.host.name config.readings.peers;
-        message = "'readings.peers' for ${config.host.name} should not include '${config.host.name}'.";
-      }
-    ];
-
-    syncthing = {
-      enable = true;
-      folders.readings = {
-        inherit (config.readings) path;
-        devices = config.readings.peers;
-      };
-    };
-
-    home-manager.sharedModules = [
-      {
-        readings.path = lib.mkDefault config.readings.path;
-      }
-    ];
-  };
-}