112 lines
2.8 KiB
Nix
112 lines
2.8 KiB
Nix
{
|
|
inputs,
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.hardening;
|
|
wakeOnLan = lib.any (iface: iface.wakeOnLan.enable) (lib.attrValues config.networking.interfaces);
|
|
randomMac = config.host.role == "laptop" && !wakeOnLan;
|
|
profiles = {
|
|
workstation = {
|
|
preset = [
|
|
"compatibility"
|
|
]
|
|
++ lib.optional config.gaming.enable "performance"; # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
|
|
settings = {
|
|
kernel.cpu-mitigations = "smt-on";
|
|
debug.debugfs = true;
|
|
etc = {
|
|
harden-bluetooth = false;
|
|
harden-gitconfig = false;
|
|
};
|
|
network = {
|
|
router-advertisements = "on";
|
|
tcp-sack = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
server = {
|
|
preset = [
|
|
"compatibility"
|
|
"maximum" # prioritized (order matters) <https://github.com/cynicsketch/nix-mineral#configuring-options>
|
|
];
|
|
settings = {
|
|
etc = {
|
|
harden-gitconfig = false;
|
|
};
|
|
debug.quiet-boot = false;
|
|
kernel.cpu-mitigations = "smt-on";
|
|
network = {
|
|
ipv6-tempaddr = false;
|
|
max-addresses = false;
|
|
neighbor-solicitations = false;
|
|
router-advertisements = "on";
|
|
router-solicitations = false;
|
|
tcp-sack = true;
|
|
};
|
|
system = {
|
|
lower-address-mmap = false;
|
|
multilib = false;
|
|
yama = "admin-only";
|
|
};
|
|
};
|
|
extras = {
|
|
kernel.warn-panic = false;
|
|
system.secure-chrony = null;
|
|
network = {
|
|
tcp-window-scaling = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
in
|
|
{
|
|
imports = [ inputs.nix-mineral.nixosModules.nix-mineral ];
|
|
|
|
options.hardening = {
|
|
enable = lib.mkEnableOption "hardening";
|
|
profile = lib.mkOption {
|
|
type = lib.types.enum [
|
|
"workstation"
|
|
"server"
|
|
];
|
|
default = "workstation";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
boot.blacklistedKernelModules = [
|
|
"dccp"
|
|
"sctp"
|
|
"rds"
|
|
"tipc"
|
|
];
|
|
networking.wireless.iwd.settings.General.AddressRandomization = lib.mkIf randomMac "network";
|
|
nix-mineral = lib.mkMerge [
|
|
{
|
|
enable = true;
|
|
filesystems.normal = {
|
|
"/tmp".enable = !config.boot.tmp.useTmpfs;
|
|
# only needed for FAT
|
|
"/boot".options.umask = lib.mkIf (
|
|
!lib.elem (config.fileSystems."/boot".fsType or null) [
|
|
"vfat"
|
|
"msdos"
|
|
"exfat"
|
|
]
|
|
) (lib.mkForce false);
|
|
};
|
|
settings.network = {
|
|
ip-forwarding = config.virtualisation.docker.enable || config.services.k3s.enable;
|
|
random-mac = randomMac;
|
|
};
|
|
}
|
|
profiles.${cfg.profile}
|
|
];
|
|
};
|
|
}
|