Hardening: Vulnix + kernel hardening

Signed-off-by: Hadi <hadi@example.fr>

nixos/vulnix.nix

@@ -0,0 +1,27 @@
+# Vulnix scans the Nix store against the NVD CVE feed to find packages with
+# known vulnerabilities.
+{pkgs, ...}: {
+  environment.systemPackages = [pkgs.vulnix];
+
+  systemd.services.vulnix-scan = {
+    description = "Scan the system closure for known vulnerabilities (vulnix)";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.vulnix}/bin/vulnix --system --cache-dir /var/cache/vulnix";
+      CacheDirectory = "vulnix";
+      # vulnix exits non-zero when it finds vulnerabilities; that's expected,
+      # don't let systemd treat the scan itself as a failure.
+      SuccessExitStatus = "1 2";
+    };
+  };
+
+  systemd.timers.vulnix-scan = {
+    description = "Daily vulnix scan";
+    wantedBy = ["timers.target"];
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+      RandomizedDelaySec = "1h";
+    };
+  };
+}