{ config, pkgs, ... }:
{
 systemd.services.systemd-rfkill = {
    serviceConfig = {
       ProtectSystem = "strict";
       ProtectHome = true;
       ProtectKernelTunables = true;
       ProtectKernelModules = true;
      ProtectControlGroups = true;
       ProtectClock = true;
       ProtectProc = "invisible";
       ProcSubset = "pid";
       PrivateTmp = true;
       MemoryDenyWriteExecute = true; #
       NoNewPrivileges = true;
       LockPersonality = true; #
       RestrictRealtime = true; #
       SystemCallFilter = [ "write" "read" "openat" "close" "brk" "fstat" "lseek" "mmap" "mprotect" "munmap" "rt_sigaction" "rt_sigprocmask" "ioctl" "nanosleep" "select" "access" "execve" "getuid" "arch_prctl" "set_tid_address" "set_robust_list" "prlimit64" "pread64" "getrandom" ];
       SystemCallArchitectures = "native";
       UMask = "0077";
       IPAddressDeny = "any";
    };
  };
systemd.services.syslog = {
serviceConfig = {
  PrivateNetwork= true;
  CapabilityBoundingSet= ["CAP_DAC_READ_SEARCH" "CAP_SYSLOG" "CAP_NET_BIND_SERVICE"];
  NoNewPrivileges= true;
  PrivateDevices= true;
  ProtectClock= true;
  ProtectKernelLogs= true;
  ProtectKernelModules= true;
  PrivateMounts= true;
  SystemCallArchitectures= "native";
  MemoryDenyWriteExecute= true;
  LockPersonality= true;
  ProtectKernelTunables= true;
  RestrictRealtime= true;
  PrivateUsers= true;
  PrivateTmp= true;
  UMask= "0077";
  RestrictNamespace = true;
  ProtectProc= "invisible";
  ProtectHome= true;
  DeviceAllow= false;
  ProtectSystem = "full";
  };
};


systemd.services.systemd-journald = {
  serviceConfig = {
  UMask = 0077;
  PrivateNetwork= true;
  ProtectHostname= true;
  ProtectKernelModules= true;
  };
};
  systemd.services.auto-cpufreq = {
    serviceConfig = {
      CapabilityBoundingSet = "";
      ProtectSystem = "full";
      ProtectHome = true;
      PrivateNetwork = true;
      IPAddressDeny = "any";
      NoNewPrivileges = true;
      ProtectKernelTunables = true;
      ProtectKernelModules = true;
      ProtectControlGroups = true;
      ProtectHostname = false;
      MemoryDenyWriteExecute = true;
      ProtectClock = true;
      RestrictNamespaces = true ;
      PrivateTmp = true;
      PrivateUsers = true;
      ProtectProc= true;
      ReadOnlyPaths = [ "/" ];
      InaccessiblePaths = [ "/home" "/root" "/proc" ];
      SystemCallFilter = [ "@system-service" ];
      SystemCallArchitectures = "native";
      UMask = "0077";
    };
  };
systemd.services.NetworkManager-dispatcher = {
  serviceConfig = {
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectHostname = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateUsers = true;
    PrivateDevices = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET";
    RestrictNamespaces = true;
    SystemCallFilter = [ "write" "read" "openat" "close" "brk" "fstat" "lseek" "mmap" "mprotect" "munmap" "rt_sigaction" "rt_sigprocmask" "ioctl" "nanosleep" "select" "access" "execve" "getuid" "arch_prctl" "set_tid_address" "set_robust_list" "prlimit64" "pread64" "getrandom" ];
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";
  };
};
 systemd.services.display-manager = {
   serviceConfig = {
        ProtectKernelTunables = true;
        ProtectKernelModules = true;
      ProtectKernelLogs = true; # so we won't need all of this
   };
 };
systemd.services.emergency = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;
    PrivateDevices = true;  # Might need adjustment for emergency access
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET";
    RestrictNamespaces = true;
    SystemCallFilter = [ "write" "read" "openat" "close" "brk" "fstat" "lseek" "mmap" "mprotect" "munmap" "rt_sigaction" "rt_sigprocmask" "ioctl" "nanosleep" "select" "access" "execve" "getuid" "arch_prctl" "set_tid_address" "set_robust_list" "prlimit64" "pread64" "getrandom" ];
    UMask = "0077";
    IPAddressDeny = "any";
  };
};
systemd.services."getty@tty1" = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;
    PrivateDevices = true;
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET";
    RestrictNamespaces = true;
    SystemCallFilter = [ "write" "read" "openat" "close" "brk" "fstat" "lseek" "mmap" "mprotect" "munmap" "rt_sigaction" "rt_sigprocmask" "ioctl" "nanosleep" "select" "access" "execve" "getuid" "arch_prctl" "set_tid_address" "set_robust_list" "prlimit64" "pread64" "getrandom" ];
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";
  };
};
systemd.services."getty@tty7" = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;
    PrivateDevices = true;
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET";
    RestrictNamespaces = true;
    SystemCallFilter = [ "write" "read" "openat" "close" "brk" "fstat" "lseek" "mmap" "mprotect" "munmap" "rt_sigaction" "rt_sigprocmask" "ioctl" "nanosleep" "select" "access" "execve" "getuid" "arch_prctl" "set_tid_address" "set_robust_list" "prlimit64" "pread64" "getrandom" ];
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";
  };
};
systemd.services.NetworkManager = {
  serviceConfig = {
  NoNewPrivileges = true;
  ProtectClock = true;
  ProtectKernelLogs = true;
  ProtectControlGroups = true;
  ProtectKernelModules = true;
  SystemCallArchitectures = "native";
  MemoryDenyWriteExecute= true;
  ProtectProc = "invisible";
  ProcSubset = "pid";
  RestrictNamespaces = true;
  ProtectKernelTunables= true;
  ProtectHome = true;
  PrivateTmp = true;
  UMask = "0077";
  };
};
  systemd.services."nixos-rebuild-switch-to-configuration" = {
    serviceConfig = {
    ProtectHome = true;
    NoNewPrivileges = true;  # Prevent gaining new privileges
   };
  };
systemd.services."dbus" = {
    serviceConfig = {
      PrivateTmp = true;
      PrivateNetwork = true;
      ProtectSystem = "full";
      ProtectHome = true;
      SystemCallFilter = "~@clock @cpu-emulation @module @mount @obsolete @raw-io @reboot @swap";
      ProtectKernelTunables = true;
      NoNewPrivileges = true;
      CapabilityBoundingSet=["~CAP_SYS_TIME" "~CAP_SYS_PACCT" "~CAP_KILL" "~CAP_WAKE_ALARM" "~CAP_SYS_BOOT" "~CAP_SYS_CHROOT" "~CAP_LEASE" "~CAP_MKNOD" "~CAP_NET_ADMIN" "~CAP_SYS_ADMIN" "~CAP_SYSLOG" "~CAP_NET_BIND_SERVICE" "~CAP_NET_BROADCAST" "~CAP_AUDIT_WRITE" "~CAP_AUDIT_CONTROL" "~CAP_SYS_RAWIO" "~CAP_SYS_NICE" "~CAP_SYS_RESOURCE" "~CAP_SYS_TTY_CONFIG" "~CAP_SYS_MODULE" "~CAP_IPC_LOCK" "~CAP_LINUX_IMMUTABLE" "~CAP_BLOCK_SUSPEND" "~CAP_MAC_*" "~CAP_DAC_*" "~CAP_FOWNER" "~CAP_IPC_OWNER" "~CAP_SYS_PTRACE" "~CAP_SETUID" "~CAP_SETGID" "~CAP_SETPCAP" "~CAP_FSETID" "~CAP_SETFCAP" "~CAP_CHOWN"];
      ProtectKernelModules= true;
ProtectKernelLogs= true;
ProtectClock= true;
ProtectControlGroups= true;
RestrictNamespaces= true;
MemoryDenyWriteExecute= true;
RestrictAddressFamilies= ["~AF_PACKET" "~AF_NETLINK"];
ProtectHostname= true;
LockPersonality= true;
RestrictRealtime= true;
PrivateUsers= true;
    };
  };
systemd.services.nix-daemon = {
  serviceConfig = {
    ProtectHome = true;
    PrivateUsers = false;
  };
};
systemd.services.reload-systemd-vconsole-setup = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    PrivateUsers = true;
    PrivateDevices = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictNamespaces = true;
    UMask = "0077";
    IPAddressDeny = "any";
  };
};
systemd.services.rescue = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;
    PrivateDevices = true;  # Might need adjustment for rescue operations
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET AF_INET6";  # Networking might be necessary in rescue mode
    RestrictNamespaces = true;
    SystemCallFilter = [ "write" "read" "openat" "close" "brk" "fstat" "lseek" "mmap" "mprotect" "munmap" "rt_sigaction" "rt_sigprocmask" "ioctl" "nanosleep" "select" "access" "execve" "getuid" "arch_prctl" "set_tid_address" "set_robust_list" "prlimit64" "pread64" "getrandom" ];
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";  # May need to be relaxed for network troubleshooting in rescue mode
  };
};
systemd.services."systemd-ask-password-console" = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;
    PrivateDevices = true;  # May need adjustment for console access
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET AF_INET6";
    RestrictNamespaces = true;
    SystemCallFilter = [ "@system-service" ];  # A more permissive filter
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";
  };
};
systemd.services."systemd-ask-password-wall" = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;
    PrivateDevices = true;
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET AF_INET6";
    RestrictNamespaces = true;
    SystemCallFilter = [ "@system-service" ];  # A more permissive filter
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";
  };
};
systemd.services.thermald = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;  # Necessary for adjusting cooling policies
    ProtectKernelModules = true;  # May need adjustment for module control
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;
    PrivateDevices = true;  # May require access to specific hardware devices
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    CapabilityBoundingSet = "";
    RestrictNamespaces = true;
    SystemCallFilter = [ "@system-service" ];
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";
    DeviceAllow= [];
    RestrictAddressFamilies = [ ];
 };
};
systemd.services."user@1000" = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;  # Be cautious, as this may restrict user operations
    PrivateDevices = true;
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET AF_INET6";
    RestrictNamespaces = true;
    SystemCallFilter = [ "@system-service" ];  # Adjust based on user needs
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";
  };
};
systemd.services.virtlockd = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;
    PrivateDevices = true;  # May need adjustment for accessing VM resources
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET AF_INET6";
    RestrictNamespaces = true;
    SystemCallFilter = [ "@system-service" ];  # Adjust as necessary
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";  # May need adjustment for network operations
  };
};
systemd.services.virtlogd = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;
    PrivateDevices = true;  # May need adjustment for accessing VM logs
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET AF_INET6";
    RestrictNamespaces = true;
    SystemCallFilter = [ "@system-service" ];  # Adjust based on log management needs
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";  # May need to be relaxed for network-based log collection
  };
};
systemd.services.virtlxcd = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;  # Necessary for container management
    ProtectKernelModules = true;
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;  # Be cautious, might need adjustment for container user management
    PrivateDevices = true;  # Containers might require broader device access
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET AF_INET6";  # Necessary for networked containers
    RestrictNamespaces = true;
    SystemCallFilter = [ "@system-service" ];  # Adjust based on container operations
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";  # May need to be relaxed for network functionality
  };
};
systemd.services.virtqemud = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;  # Necessary for VM management
    ProtectKernelModules = true;  # May need adjustment for VM hardware emulation
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;  # Be cautious, might need adjustment for VM user management
    PrivateDevices = true;  # VMs might require broader device access
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET AF_INET6";  # Necessary for networked VMs
    RestrictNamespaces = true;
    SystemCallFilter = [ "@system-service" ];  # Adjust based on VM operations
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";  # May need to be relaxed for network functionality
  };
};
systemd.services.virtvboxd = {
  serviceConfig = {
    ProtectSystem = "strict";
    ProtectHome = true;
    ProtectKernelTunables = true;  # Required for some VM management tasks
    ProtectKernelModules = true;  # May need adjustment for module handling
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectClock = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    PrivateTmp = true;
    PrivateUsers = true;  # Be cautious, might need adjustment for VM user management
    PrivateDevices = true;  # VMs may require access to certain devices
    PrivateIPC = true;
    MemoryDenyWriteExecute = true;
    NoNewPrivileges = true;
    LockPersonality = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    RestrictAddressFamilies = "AF_INET AF_INET6";  # Necessary for networked VMs
    RestrictNamespaces = true;
    SystemCallFilter = [ "@system-service" ];  # Adjust based on VM operations
    SystemCallArchitectures = "native";
    UMask = "0077";
    IPAddressDeny = "any";  # May need to be relaxed for network functionality
  };
};
}