milestone 20: declarative configuration for iac

deploy/systemd/nxdns.service

@@ -16,6 +16,11 @@ StateDirectoryMode=0700
 LogsDirectory=nxdns
 ConfigurationDirectory=nxdns
 
+# ConfigurationDirectory creates /etc/nxdns owned by the service user. nxdns
+# never writes there in either authority mode, and in file mode that directory
+# holds the source of truth, so deny the write outright rather than rely on it.
+ReadOnlyPaths=/etc/nxdns
+
 # Port 53 (and 443/853 when the DoH/DoT listeners are enabled).
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
@@ -44,6 +49,9 @@ SystemCallArchitectures=native
 
 Restart=on-failure
 RestartSec=2
+# Exit 2 is a configuration fault and 64 is a usage error. Neither clears on a
+# retry, so a restart loop only buries the diagnostics already in the journal.
+RestartPreventExitStatus=2 64
 
 [Install]
 WantedBy=multi-user.target