{
  inputs,
  config,
  lib,
  ...
}:

let
  cfg = config.hardening;
  wakeOnLan = lib.any (iface: iface.wakeOnLan.enable) (lib.attrValues config.networking.interfaces);
  randomMac = config.host.role == "laptop" && !wakeOnLan;
  profiles = {
    workstation = {
      preset = [
        "compatibility"
      ]
      ++ lib.optional config.gaming.enable "performance"; # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
      settings = {
        kernel.cpu-mitigations = "smt-on";
        debug.debugfs = true;
        etc = {
          harden-bluetooth = false;
          harden-gitconfig = false;
        };
        network = {
          router-advertisements = "on";
          tcp-sack = true;
        };
      };
    };

    server = {
      preset = [
        "compatibility"
        "maximum" # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
      ];
      settings = {
        etc = {
          harden-gitconfig = false;
        };
        debug.quiet-boot = false;
        kernel.cpu-mitigations = "smt-on";
        network = {
          ipv6-tempaddr = false;
          max-addresses = false;
          neighbor-solicitations = false;
          router-advertisements = "on";
          router-solicitations = false;
          tcp-sack = true;
        };
        system = {
          lower-address-mmap = false;
          multilib = false;
          yama = "admin-only";
        };
      };
      extras = {
        kernel.warn-panic = false;
        system.secure-chrony = null;
        network = {
          tcp-window-scaling = true;
        };
      };
    };
  };
in
{
  imports = [ inputs.nix-mineral.nixosModules.nix-mineral ];

  options.hardening = {
    enable = lib.mkEnableOption "hardening";
    profile = lib.mkOption {
      type = lib.types.enum [
        "workstation"
        "server"
      ];
      default = "workstation";
    };
  };

  config = lib.mkIf cfg.enable {
    boot.blacklistedKernelModules = [
      "dccp"
      "sctp"
      "rds"
      "tipc"
    ];
    networking.wireless.iwd.settings.General.AddressRandomization = lib.mkIf randomMac "network";
    nix-mineral = lib.mkMerge [
      {
        enable = true;
        filesystems.normal = {
          "/tmp".enable = !config.boot.tmp.useTmpfs;
          # only needed for FAT
          "/boot".options.umask = lib.mkIf (
            !lib.elem (config.fileSystems."/boot".fsType or null) [
              "vfat"
              "msdos"
              "exfat"
            ]
          ) (lib.mkForce false);
        };
        settings.network = {
          ip-forwarding = config.virtualisation.docker.enable || config.services.k3s.enable;
          random-mac = randomMac;
        };
      }
      profiles.${cfg.profile}
    ];
  };
}