nixos/isso: systemd unit hardening

        Restart = "on-failure";

        RestartSec = 1;

        # Hardening

        CapabilityBoundingSet = [ "" ];

        DeviceAllow = [ "" ];

        LockPersonality = true;

        PrivateDevices = true;

        PrivateUsers = true;

        ProcSubset = "pid";

        ProtectClock = true;

        ProtectControlGroups = true;

        ProtectHome = true;

        ProtectHostname = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "invisible";

        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];

        RestrictNamespaces = true;

        RestrictRealtime = true;

        SystemCallArchitectures = "native";

        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];

        UMask = "0077";

      };

    };

  };