A NixOS module for system hardening that tightens kernel, network and filesystem settings and reduces attack surface through presets and options.