{ config, ... }:

{
  # Common hardening flags. Define here, use in any file
  options = {
    my.commonFlags = lib.mkOption { types = lib.types.attrs; };
  };

  # Set your flags here
  config.my.commonFlags = { NoNewPrivileges = true; PrivateTmp = true; ProtectSystem = true; ProtectHome = true; };

  # Have to add config to the name, because we used "options" in this file
  config.systemd.services.rtorrent.serviceConfig = config.my.commonFlags // { ProtectHome = "read-only"; };
}