I don't need to tell you this, but Nix is pretty good:
- NixOS configurations force you to declare attack surfaces (user groups, open ports) explicitly
- Nixpkgs is the largest package repository ever, so you rarely have to rely on 3rd-party packages
- Nixpkgs tends to ship security fixes quickly
- NixOS and many of its packages are open source
But it comes with a few pitfalls:
- Only import Flakes or modules from trusted authors. I would avoid the NUR completely, because it incentivizes the opposite
- Some far-reaching security fixes (such as the recent one for PHP) trigger long rebuilds before they reach the main
nixoschannels. Usenixos-unstable-smallto override vulnerable packages in the meantime
I use LUKS disk encryption and Lanzabote secure boot to secure my data at rest. Not because I'm scared of anyone breaking into my house, but for the peace of mind that the data is gone once I erase the encryption key.
For privacy, I use LibreWolf with default security settings and a VPN.
Other than that, I don't feel the need to harden my personal computer. That is of course a different story for servers with open ports. The NixOS wiki entry for Security also contains some useful links.
UnifiedPush lets you receive Android notifications from a server. Ntfy in particular lets you create URLs that receive notifications. You can post to that URL using the ntfy CLI, Curl or the programming language of your choice.