From 478f6b2b4bdba66f02f0d1dfa3cff17f6133beee Mon Sep 17 00:00:00 2001
From: Freya Murphy <freya@freyacat.org>
Date: Wed, 31 Dec 2025 13:38:01 -0500
Subject: add hardening module

---
 system/hardened.nix | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 system/hardened.nix

(limited to 'system/hardened.nix')

diff --git a/system/hardened.nix b/system/hardened.nix
new file mode 100644
index 0000000..223b358
--- /dev/null
+++ b/system/hardened.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  config,
+  inputs,
+  ...
+}: let
+  inherit (lib) mkIf;
+in {
+  imports = [
+    inputs.nix-mineral.nixosModules.nix-mineral
+  ];
+
+  config = mkIf config.hardened {
+    nix-mineral = {
+      enable = true;
+      settings = {
+        debug = {
+          coredump = true;
+          zram = false;
+        };
+        network = {
+          icmp = {
+            cast = true;
+            ignore-all = false;
+          };
+        };
+        kernel = {
+          cpu-mitigations = "smt-on";
+          io-uring = true;
+          lockdown = true;
+          only-signed-modules = true;
+          pti = true;
+          sysrq = "none";
+        };
+        system = {
+          yama = "relaxed";
+        };
+      };
+      extras = {
+        kernel = {
+          intelme-kmodules = false;
+        };
+        system = {
+          secure-chrony = true;
+          unprivileged-userns = false;
+        };
+      };
+      filesystems = {
+        normal = {
+          # let me run shell scripts
+          # please and thank you
+          "/home".options.noexec = lib.mkForce false;
+          "/etc".options.noexec = lib.mkForce true;
+        };
+      };
+    };
+  };
+}
-- 
cgit v1.2.3-freya