feat(sandboxing): declare sandboxing module

hosts/andromache/default.nix

@@ -68,6 +68,7 @@ in
       "/data"
     ];
   };
+  sandboxing.enable = true;
   secrets = {
     enable = true;
     nixSigningKey.enable = true;

hosts/astyanax/default.nix

@@ -52,6 +52,7 @@ in
     };
   };
   networking.enable = true;
+  sandboxing.enable = true;
   secrets.enable = true;
   ssh.enable = true;
   storage.enable = true;

modules/sandboxing/default.nix

@@ -0,0 +1,17 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.sandboxing;
+in
+{
+  options.sandboxing.enable = lib.mkOption { default = false; };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.bubblewrap ];
+  };
+}