security: add conservative systemd hardening to aquamarine services

hosts/idols-aquamarine/service-hardening.nix

@@ -0,0 +1,38 @@
+{ lib, ... }:
+let
+  # Universally-safe systemd sandboxing for network-facing services: no
+  # filesystem-write impact and cannot break a well-behaved service.
+  # ProtectSystem/ProtectHome/ReadWritePaths are intentionally EXCLUDED
+  # (they risk breaking services; fix upstream in nixpkgs instead).
+  safe = {
+    NoNewPrivileges = true;
+    PrivateTmp = true;
+    ProtectKernelTunables = true;
+    ProtectKernelModules = true;
+    ProtectKernelLogs = true;
+    ProtectKernelReadonly = true;
+    ProtectKernelIntegrity = true;
+    ProtectKernelDevelopment = true;
+    ProtectControlGroups = true;
+    ProtectClock = true;
+    ProtectHostname = true;
+    RestrictRealtime = true;
+    SystemCallArchitectures = [ "native" ];
+  };
+  services = [
+    "caddy"
+    "postgresql"
+    "gitea"
+    "sftpgo"
+    "v2ray"
+    "transmission"
+  ];
+in
+{
+  systemd.services = lib.listToAttrs (
+    map (s: {
+      name = s;
+      value.serviceConfig = safe;
+    }) services
+  );
+}

outputs/x86_64-linux/tests/security-service-hardening/expected.nix

@@ -0,0 +1,12 @@
+{
+  lib,
+  outputs,
+}:
+{
+  caddy = true;
+  postgresql = true;
+  gitea = true;
+  sftpgo = true;
+  v2ray = true;
+  transmission = true;
+}

outputs/x86_64-linux/tests/security-service-hardening/expr.nix

@@ -0,0 +1,18 @@
+{
+  lib,
+  outputs,
+}:
+let
+  cfg = outputs.nixosConfigurations.aquamarine.config;
+  # NoNewPrivileges on a service (all six exist on aquamarine). Note: the
+  # `? name` exists-check misbehaves on systemd.services here, so access directly.
+  svc = name: (cfg.systemd.services.${name}.serviceConfig or { }).NoNewPrivileges or false;
+in
+{
+  caddy = svc "caddy";
+  postgresql = svc "postgresql";
+  gitea = svc "gitea";
+  sftpgo = svc "sftpgo";
+  v2ray = svc "v2ray";
+  transmission = svc "transmission";
+}