niksos/hosts/common/core/fs-hardening.nix

_: {
    fileSystems = let
        defaults = [ "nodev" "nosuid" "noexec" ];
    in {
        "/boot".options = defaults;
        "/var/log".options = defaults;
    };
}