I don't have one handy, though if you might find one in the documentation for Tails linux OS.
At a high level, the client workstation must not be allowed to send any packets to anything other than the socks port running on the Tor host. The Workstation must have a static arp entry for it's gateway. The Workstation should use a ram-disk linux distro and not persist anything to unencrypted disk. The Tor host must not allow anything inbound other than the Tor SOCKS port. The Tor node must only speak outbound on 80 and 443 (formerly known as the fascist firewall setup). Ideally, the Tor node should be running on a cheap VPS host, ideally payed for with a burner card and accessed via a VPN so that Tor traffic from the home ISP is not evident. The VPS host should be cycled from time to time.
This is of course a lot of setup work, but most of it can be automated.
[Edit] Speak of the devil. Here is a zero-day published on the Tor browser [1]
[1] - https://www.zdnet.com/article/exploit-vendor-drops-tor-brows...
