ark/modules/security/mitigations.nix

{
  config,
  lib,
  ...
}:
with lib; let
  inherit (builtins) readFile fetchurl;
  cfg = config.security.mitigations;
  cmdline = ''
    ibrs noibpb nopti nospectre_v2 nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off tsx=on tsx_async_abort=off mitigations=off'';
in {
  options = {
    security.mitigations.disable =
      mkOption
      {
        type = types.bool;
        default = false;
        description = ''
          Whether to disable spectre and meltdown mitigations in the kernel. Do
          not use this in mission critical deployments, or on any machine you do
          not have physical access to.
        '';
      };
  };
  config = mkIf cfg.disable {boot.kernelParams = splitString " " cmdline;};
}