feat(sandboxing): declare sandboxing module

hosts/andromache/default.nix

@@ -68,6 +68,7 @@ in
       "/data"
     ];
   };
+  sandboxing.enable = true;
   secrets = {
     enable = true;
     nixSigningKey.enable = true;

hosts/astyanax/default.nix

@@ -52,6 +52,7 @@ in
     };
   };
   networking.enable = true;
+  sandboxing.enable = true;
   secrets.enable = true;
   ssh.enable = true;
   storage.enable = true;

hosts/hecuba/default.nix

@@ -50,7 +50,10 @@ in
     ];
   };
 
-  virtualisation.arion.backend = "docker";
+  virtualisation.arion = {
+    backend = "docker";
+    package = pkgs.arion;
+  };
 
   networking.hostName = config.host.name;
 
@@ -112,6 +115,6 @@ in
       enable = true;
       maxretry = 5;
     };
-    journald.extraConfig = "SystemMaxUse=500M";
+    journald.settings.Journal.SystemMaxUse = "500M";
   };
 }

modules/sandboxing/default.nix

@@ -0,0 +1,17 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.sandboxing;
+in
+{
+  options.sandboxing.enable = lib.mkOption { default = false; };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.bubblewrap ];
+  };
+}