commit 00a39d3964625e18d1c36995c383f0648f314305 · pyrox.dev/nixpkgs

+45 -5
nixos/modules/services/networking/blocky.nix
···

       30
       30
        
         config = lib.mkIf cfg.enable {

     

       31
       31
        
           systemd.services.blocky = {

     

       32
       32
        
             description = "A DNS proxy and ad-blocker for the local network";

     

       33
       33
       -
             wantedBy = [ "multi-user.target" ];

     

       34
       34
       -
       

     

       33
       33
       +
             wants = [

     

       34
       34
       +
               "network-online.target"

     

       35
       35
       +
               "nss-lookup.target"

     

       36
       36
       +
             ];

     

       37
       37
       +
             before = [

     

       38
       38
       +
               "nss-lookup.target"

     

       39
       39
       +
             ];

     

       40
       40
       +
             wantedBy = [

     

       41
       41
       +
               "multi-user.target"

     

       42
       42
       +
             ];

     

       35
       43
        
             serviceConfig = {

     

       44
       44
       +
               AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

     

       45
       45
       +
               CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];

     

       36
       46
        
               DynamicUser = true;

     

       37
       47
        
               ExecStart = "${lib.getExe cfg.package} --config ${configFile}";

     

       48
       48
       +
               LockPersonality = true;

     

       49
       49
       +
               LogsDirectory = "blocky";

     

       50
       50
       +
               MemoryDenyWriteExecute = true;

     

       51
       51
       +
               NoNewPrivileges = true;

     

       52
       52
       +
               NonBlocking = true;

     

       53
       53
       +
               PrivateDevices = true;

     

       54
       54
       +
               ProtectClock = true;

     

       55
       55
       +
               ProtectControlGroups = true;

     

       56
       56
       +
               ProtectHome = true;

     

       57
       57
       +
               ProtectHostname = true;

     

       58
       58
       +
               ProtectKernelLogs = true;

     

       59
       59
       +
               ProtectKernelModules = true;

     

       60
       60
       +
               ProtectKernelTunables = true;

     

       61
       61
       +
               ProtectSystem = "strict";

     

       38
       62
        
               Restart = "on-failure";

     

       39
       39
       -
       

     

       40
       40
       -
               AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

     

       41
       41
       -
               CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];

     

       63
       63
       +
               RestrictAddressFamilies = [

     

       64
       64
       +
                 "AF_INET"

     

       65
       65
       +
                 "AF_INET6"

     

       66
       66
       +
               ];

     

       67
       67
       +
               RestrictNamespaces = true;

     

       68
       68
       +
               RestrictRealtime = true;

     

       69
       69
       +
               RuntimeDirectory = "blocky";

     

       70
       70
       +
               StateDirectory = "blocky";

     

       71
       71
       +
               SystemCallArchitectures = "native";

     

       72
       72
       +
               SystemCallFilter = [

     

       73
       73
       +
                 "@system-service"

     

       74
       74
       +
                 "@chown"

     

       75
       75
       +
                 "~@aio"

     

       76
       76
       +
                 "~@keyring"

     

       77
       77
       +
                 "~@memlock"

     

       78
       78
       +
                 "~@setuid"

     

       79
       79
       +
                 "~@timer"

     

       80
       80
       +
               ];

     

       42
       81
        
             };

     

       43
       82
        
           };

     

       44
       83
        
         };

     

       84
       84
       +
         meta.maintainers = with lib.maintainers; [ paepcke ];

     

       45
       85
        
       }