Enable hardened kernel and auto optimize

nixos/boxes/foureighty.nix

@@ -4,7 +4,6 @@
 
   networking.hostName = "foureighty";
   boot = {
-    kernelPackages = pkgs.linuxPackages_latest;
     extraModulePackages = with config.boot.kernelPackages; [ wireguard ];
     initrd.kernelModules = [ "i915" ];
     initrd.availableKernelModules = [
@@ -55,30 +54,30 @@
       };
       wantedBy = [
         "timers.target"
-        ];
-        };
+      ];
+    };
 
-        systemd.timers.cpu-throttling = {
-        enable = true;
-        description = "CPU Throttling Fix";
-        documentation = [
-          "https://wiki.archlinux.org/index.php/Lenovo_ThinkPad_X1_Carbon_(Gen_6)#Power_management.2FThrottling_issues"
-        ];
-        timerConfig = {
-          OnActiveSec = 60;
-          OnUnitActiveSec = 60;
-          Unit = "cpu-throttling.service";
-        };
-        wantedBy = [
-          "timers.target"
-          ];
-          };
+    systemd.timers.cpu-throttling = {
+      enable = true;
+      description = "CPU Throttling Fix";
+      documentation = [
+        "https://wiki.archlinux.org/index.php/Lenovo_ThinkPad_X1_Carbon_(Gen_6)#Power_management.2FThrottling_issues"
+      ];
+      timerConfig = {
+        OnActiveSec = 60;
+        OnUnitActiveSec = 60;
+        Unit = "cpu-throttling.service";
+      };
+      wantedBy = [
+        "timers.target"
+      ];
+    };
 
-          imports = [
-          /etc/nixos/hardware-configuration.nix
-          ../boot.nix
-          ../common.nix
-          ../gfx-intel.nix
-          ../virtualbox.nix
-          ];
-          }
+    imports = [
+      /etc/nixos/hardware-configuration.nix
+      ../boot.nix
+      ../common.nix
+      ../gfx-intel.nix
+      ../virtualbox.nix
+    ];
+  }

nixos/common.nix

@@ -105,7 +105,13 @@ in
       hardware.sane.enable = true;
       powerManagement.cpuFreqGovernor = (lib.mkForce null);
 
+      boot.kernelPackages = pkgs.linuxPackages_latest_hardened;
+
       nix.gc.automatic = true;
+      nix.autoOptimiseStore = true;
+      nix.optimise.automatic = true;
+      nix.daemonIONiceLevel = 7;
+      nix.daemonNiceLevel = 19;
       system.autoUpgrade.enable = true;
       system.stateVersion = "19.03";
     }

nixos/gfx-intel.nix

@@ -5,7 +5,6 @@
   hardware.opengl = {
     enable = true;
     driSupport = true;
-    driSupport32Bit = true;
     extraPackages = with pkgs; [
       vaapiIntel
       vaapiVdpau