{"id":14517536,"url":"https://github.com/cynicsketch/nix-mineral","last_synced_at":"2026-04-01T21:50:53.952Z","repository":{"id":239237262,"uuid":"798960572","full_name":"cynicsketch/nix-mineral","owner":"cynicsketch","description":"Conveniently and reasonably harden NixOS.","archived":false,"fork":false,"pushed_at":"2026-03-16T17:39:53.000Z","size":681,"stargazers_count":460,"open_issues_count":31,"forks_count":25,"subscribers_count":9,"default_branch":"main","last_synced_at":"2026-03-28T01:54:11.066Z","etag":null,"topics":["nix","nixos","privacy","security"],"latest_commit_sha":null,"homepage":"https://cynicsketch.github.io/nix-mineral/","language":"Nix","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cynicsketch.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"docs/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-05-10T21:02:28.000Z","updated_at":"2026-03-27T06:20:16.000Z","dependencies_parsed_at":null,"dependency_job_id":"f41187b3-4fec-4ff3-8338-e95fa8e4427a","html_url":"https://github.com/cynicsketch/nix-mineral","commit_stats":null,"previous_names":["cynicsketch/nix-mineral"],"tags_count":11,"template":false,"template_full_name":null,"purl":"pkg:github/cynicsketch/nix-mineral","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cynicsketch%2Fnix-mineral","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cynicsketch%2Fnix-mineral/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cynicsketch%2Fnix-mineral/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cynicsketch%2Fnix-mineral/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cynicsketch","download_url":"https://codeload.github.com/cynicsketch/nix-mineral/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cynicsketch%2Fnix-mineral/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31292576,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-01T21:15:39.731Z","status":"ssl_error","status_checked_at":"2026-04-01T21:15:34.046Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["nix","nixos","privacy","security"],"created_at":"2024-09-04T03:01:18.299Z","updated_at":"2026-04-01T21:50:53.944Z","avatar_url":"https://github.com/cynicsketch.png","language":"Nix","funding_links":[],"categories":["NixOS Modules","Nix"],"sub_categories":["Zig"],"readme":"# nix-mineral\n`nix-mineral` is a NixOS module for convenient system hardening.\nRather than be named after a mineral, it's named after the word \"mineral\".\n\n## WARNING\n`nix-mineral` is Alpha software! Loss of data or functionality may occur, especially on non-fixed releases, and user cooperation in debugging is expected!\n\n## Documentation and scope\nAll documentation and options can be viewed at https://cynicsketch.github.io/nix-mineral/.\n\nFor development simplicity, target systems are assumed to be running `nixos-unstable.` Incompatibility may occur with renamed options,\nwhich should be manually overridden if necessary.\n\n`nix-mineral` aims to serve as a drop-in addition to any NixOS system.\n\nBecause of this, complete overhauls of system UX or architecture is infeasible compared to dedicated security focused operating systems with complete executive control over design.\n\nBy default, `nix-mineral` reduces attack surface by securely configuring existing software. It is not magic, but it's better than nothing.\n\n`nix-mineral`'s threat model assumes non-state adversaries, and anonymity is\nnot considered.\n\nFor more information on, refer to the documents below.\n\nContributing guidelines: [CONTRIBUTING](docs/CONTRIBUTING.md) \\\nAdditional resources: [ADDITIONAL-RESOURCES](docs/ADDITIONAL-RESOURCES.md) \\\nOmitted features: [OMITTED](docs/OMITTED.md)\n\n## Features\nA full rundown of features is best obtained by reading the individual submodules\nfor every option `nix-mineral` offers.\n\nSome notable features include:\n- Filesystem hardening with both systemd-tmpfiles and mount options\n- Extensive kernel hardening using sysctl and boot parameters\n- Network hardening through sysctl and configuration of relevant services\n- Attack surface reduction by an extensive kernel module blacklist\n- System entropy hardening\n\n## Usage\n\n### Automatic Installation (fetchgit)\nMay be used with or without flakes. However, the flake specific method in the next section is preferred because it allows version pinning.\n\nSince we are using flake-compat inside the project, you can use the `nix-mineral` without needing to have flakes enabled, using `fetchGit`\n\nExample with fetchgit:\n```nix\nlet\n    nix-mineral = builtins.fetchGit {\n      url = \"https://github.com/cynicsketch/nix-mineral.git\";\n    };\nin\n{\n  imports = [\n    nix-mineral.nixosModules.nix-mineral\n  ];\n\n  nix-mineral = {\n    enable = true;\n  };\n}\n```\n### Usage With Flakes\n\nFor use in flake enabled systems, and to enable automatic updates and version pinning, use this method.\n\nAdd nix-mineral as an input to your flake:\n\n```nix\n{\n  description = \"Example flake for using nix-mineral\";\n\n  inputs = {\n    nixpkgs.url = \"github:nixos/nixpkgs?ref=nixos-unstable\";\n\n    nix-mineral.url = \"github:cynicsketch/nix-mineral/\"; # Refers to the main branch and is updated to the latest commit when you use \"nix flake update\"\n\n    # Note that due to major breaking changes, the below examples are not compatible with commits or releases prior to 0.2.0a!\n\n    # nix-mineral.url = \"github:cynicsketch/nix-mineral/v0.2.0-alpha\" # Refers to a specific tag and follows that tag until you change it\n    # nix-mineral.url = \"github:cynicsketch/nix-mineral/reallylongexamplehashforthecommitandall9\" # Refers to a specific commit and follows that until you change it\n  };\n\n  outputs =\n    { nixpkgs, ... }@inputs:\n    {\n      nixosConfigurations.ExampleSystem = nixpkgs.lib.nixosSystem {\n        system = \"x86_64-linux\";\n\n        specialArgs = {\n          inherit inputs;\n        };\n\n        modules = [\n          ./configuration.nix\n        ];\n      };\n    };\n}\n```\n\nImport nix-mineral.nix from the input and enable the module:\n\n```nix\n{ inputs, ... }:\n\n{\n  imports = [\n    inputs.nix-mineral.nixosModules.nix-mineral\n  ];\n\n  nix-mineral = {\n    enable = true;\n  };\n}\n```\n\n### Configuring options\nIt is likely you will need to change some options in order to make your\nindividual hardware and software configuration function as intended.\n\nPresets for doing so are available in the [presets directory](https://github.com/cynicsketch/nix-mineral/tree/main/presets)\nof this repository.\n\nRefer to the individual submodules for more information on what each option does.\n\nAn example configuration to enable all defaults, use the \"compatibility\" preset, and then disable TCP window\nscaling while enabling multilib support and IP forwarding functionality is\nshown below.\n```nix\n{\n    nix-mineral = {\n        enable = true;\n        preset = \"compatibility\";\n\n        settings = {\n            # kernel = {\n            #     only-signed-modules = true;\n            #     lockdown = true;\n            #     ...\n            # };\n            system.multilib = true;\n            network = {\n                ip-forwarding = true;\n            };\n        };\n    };\n\n    nix-mineral.settings.network.tcp-window-scaling = false;\n}\n```\n\n#### Contributing\nHave any ideas for the project? Want to help improve it by writing code or documentation? Head to the [issues tracker](https://github.com/cynicsketch/nix-mineral/issues) and we can talk a solution!\nContributing guidelines: [CONTRIBUTING.MD](docs/CONTRIBUTING.md)\n\n### Credits\nSpecial thanks to all our [wonderful contributors](https://github.com/cynicsketch/nix-mineral/graphs/contributors) who have helped make this project possible, as well many other projects, named and unnamed, which `nix-mineral` has borrowed insight and configuration from:\n\nOriginal basis for hardening, of which many of the below have themselves derived from: \\\nURL: https://madaidans-insecurities.github.io/guides/linux-hardening.html \\\nArchive: https://web.archive.org/web/20220320000126/https://madaidans-insecurities.github.io/guides/linux-hardening.html\n\nAdditionally used is privsec's Desktop Linux Hardening: \\\nURL: https://privsec.dev/posts/linux/desktop-linux-hardening/ \\\nArchive: https://web.archive.org/web/20240629135847/https://privsec.dev/posts/linux/desktop-linux-hardening/#kernel\n\nBluetooth configuration and module blacklist, with various additional settings inspiration from Kicksecure's security-misc: \\\nURL: https://github.com/Kicksecure/security-misc\n\nSupplement to sysctl configuration borrowed from Tommy's Linux-Setup-Scripts: \\\nURL: https://github.com/Metropolis-nexus/Common-Files/blob/main/etc/sysctl.d/99-workstation.conf\n\nOptional chrony configuration was borrowed from GrapheneOS server infrastructure: \\\nURL: https://github.com/GrapheneOS/infrastructure\n\nOriginal idea to restrict nix to wheel user from Xe Iaso: \\\nURL: https://xeiaso.net/blog/paranoid-nixos-2021-07-18/\n\nVarious security-relevant sysctl configuration from K4YT3X's sysctl: \\\nURL: https://github.com/k4yt3x/sysctl/blob/master/sysctl.conf\n\nThe `hardened.nix` profile upstream, which inspired this project: \\\nURL: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix\n\nnix-bitcoin's hardening, which has also inspired this project: \\\nURL: https://github.com/fort-nix/nix-bitcoin\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcynicsketch%2Fnix-mineral","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcynicsketch%2Fnix-mineral","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcynicsketch%2Fnix-mineral/lists"}