Software:

• firewall, no inbound and do outbound restrictions
• use immutable OS
• full disk encryption (keep in mind that in many setups you will need to be beside the computer after restart)

Hardware:

• put it in the trusted datacenter (home stuff is not safe from teenagers and people that need computer’s electrical socket for a vacuum cleaner)

Maybe this can be of use for you, it’s not declarative but it is in Nix, it shouldn’t be too hard for someone to make it declarative: https://github.com/matejc/win11