systemd
Enable persistent journaling for journald
This seems unnecessary, at least in Debian 13. The journal path already exists, and journald.conf Storage key defaults to auto so it should use it without any changes.
Create the expected storage location. Send USR1 signal to journald, and it will write out the log currently stored in memory.
mkdir -p /var/log/journal systemd-tmpfiles --create --prefix /var/log/journal killall -USR1 systemd-journald
Disable ctrl-alt-del reboot target.
systemctl mask ctrl-alt-del.target