Sovereign-nix: four NixOS modules for making a machine expensive to attack at scale

An exploit is cheap because it fits millions of identical systems. These four modules attack that economy rather than any particular bug. They are independent, each has one enable option, and none imports another take one or take all four. sovereign.harden — kernel sysctls, boot parameters, key-only sshd with modern crypto, default-deny firewall, Nix sandbox on. sovereign.diversity one pure function turns a per-host seed into reproducible values: SSH port, MAC randomisation, harmless kernel...