Comment by dml2135

Use NixOS, only give your model access to the config in a git repo, zero access to the actual host machine.