nixos/envoy: further service hardening

        # Hardening

        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];

        DeviceAllow = [ "" ];

        DevicePolicy = "closed";

        DynamicUser = true;

        LockPersonality = true;

        MemoryDenyWriteExecute = false; # at least wasmr needs WX permission

        PrivateDevices = true;

        PrivateUsers = false; # breaks CAP_NET_BIND_SERVICE

        ProcSubset = "pid";

        ProtectClock = true;

        ProtectControlGroups = true;

        ProtectHome = true;

        RestrictNamespaces = true;

        RestrictRealtime = true;

        SystemCallArchitectures = "native";

        SystemCallFilter = [ "~@clock" "~@module" "~@mount" "~@reboot" "~@swap" "~@obsolete" "~@cpu-emulation" ];

        SystemCallErrorNumber = "EPERM";

        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];

        UMask = "0066";

      };

    };