- hardened.nix: main module with toggle options for each subsystem - impermanence.nix: btrfs rollback with neededForBoot fix - secureboot.nix: Lanzaboote with boot.loader.systemd-boot - luks.nix: LUKS2 with disko-provided device path - kernel.nix: hardened sysctl and boot params (kernel.sysrq fix) - apparmor.nix: killUnconfinedConfinables option - agenix.nix: TPM-backed secrets with /var/lib/agenix persistence - user.nix: non-root user with SSH key auth