added some security options

flake.nix

@@ -79,6 +79,30 @@
           serviceConfig = {
             ExecStart = "${cfg.package}/bin/sTodo";
             Restart = "always";
+            User = "sTodo";
+            Group = "sTodo";
+            StateDirectory = "sTodo";
+            StateDirectoryMode = "0700";
+
+            AmbientCapabilities = "";
+            CapabilityBoundingSet = "";
+            DeviceAllow = "";
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            NoNewPrivileges = true;
+
+            PrivateDevices = true;
+            PrivateUsers = true;
+
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = "read-only";
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "noaccess";
+            ProtectSystem = "strict";
           };
           environment = {
             YESOD_PORT = "${toString cfg.port}";