nix-mineral

Implements filesystem, kernel, network, and entropy hardening with extensive sysctl settings and kernel module blacklists, derived from established security guides like Madaidans-insecurities and Kicksecure.

Serves as a drop-in module that can be added to any NixOS configuration via imports, enabling security improvements without complete system overhauls, as highlighted in the documentation.

Offers compatibility presets to ease adoption and focuses on practical improvements within existing constraints, acknowledging it's 'better than nothing' for real-world use.

Credits contributors and references multiple security projects (e.g., GrapheneOS, nix-bitcoin), ensuring the configuration borrows from experienced and tested sources.