commit 0191ef9253b207d0d7aa4e143b5f5417e36130b7 · pyrox.dev/nixpkgs

+38 -4
nixos/modules/programs/clash-verge.nix
···

       7
       7
        
       

     

       8
       8
        
       {

     

       9
       9
        
         imports = [

     

       10
       10
       -
           (lib.mkRemovedOptionModule [ "programs" "clash-verge" "tunMode" ] ''

     

       11
       11
       -
             The tunMode will work with service mode which is enabled by default.

     

       12
       12
       -
           '')

     

       13
       10
        
         ];

     

       14
       11
        
         options.programs.clash-verge = {

     

       15
       12
        
           enable = lib.mkEnableOption "Clash Verge";

     
···

       23
       20
        
             default = pkgs.clash-verge-rev;

     

       24
       21
        
             defaultText = lib.literalExpression "pkgs.clash-verge-rev";

     

       25
       22
        
           };

     

       23
       23
       +
           serviceMode = lib.mkEnableOption "Service Mode";

     

       24
       24
       +
           tunMode = lib.mkEnableOption "Setcap for TUN Mode. DNS settings won't work on this way";

     

       26
       25
        
           autoStart = lib.mkEnableOption "Clash Verge auto launch";

     

       27
       26
        
         };

     

       28
       27
        
       

     
···

       42
       41
        
               ))

     

       43
       42
        
             ];

     

       44
       43
        
       

     

       45
       45
       -
             systemd.services.clash-verge = {

     

       44
       44
       +
             security.wrappers.clash-verge = lib.mkIf cfg.tunMode {

     

       45
       45
       +
               owner = "root";

     

       46
       46
       +
               group = "root";

     

       47
       47
       +
               capabilities = "cap_net_bind_service,cap_net_raw,cap_net_admin=+ep";

     

       48
       48
       +
               source = "${lib.getExe cfg.package}";

     

       49
       49
       +
             };

     

       50
       50
       +
       

     

       51
       51
       +
             systemd.services.clash-verge = lib.mkIf cfg.serviceMode {

     

       46
       52
        
               enable = true;

     

       47
       53
        
               description = "Clash Verge Service Mode";

     

       48
       54
        
               serviceConfig = {

     

       49
       55
        
                 ExecStart = "${cfg.package}/bin/clash-verge-service";

     

       50
       56
        
                 Restart = "on-failure";

     

       57
       57
       +
                 ProtectSystem = "strict";

     

       58
       58
       +
                 NoNewPrivileges = true;

     

       59
       59
       +
                 ProtectHostname = true;

     

       60
       60
       +
                 ProtectProc = "invisible";

     

       61
       61
       +
                 ProcSubset = "pid";

     

       62
       62
       +
                 SystemCallArchitectures = "native";

     

       63
       63
       +
                 PrivateTmp = true;

     

       64
       64
       +
                 PrivateMounts = true;

     

       65
       65
       +
                 ProtectKernelTunables = true;

     

       66
       66
       +
                 ProtectKernelModules = true;

     

       67
       67
       +
                 ProtectKernelLogs = true;

     

       68
       68
       +
                 ProtectControlGroups = true;

     

       69
       69
       +
                 LockPersonality = true;

     

       70
       70
       +
                 RestrictRealtime = true;

     

       71
       71
       +
                 ProtectClock = true;

     

       72
       72
       +
                 MemoryDenyWriteExecute = true;

     

       73
       73
       +
                 RestrictSUIDSGID = true;

     

       74
       74
       +
                 RestrictNamespaces = [ "~user cgroup ipc mnt uts" ];

     

       75
       75
       +
                 RestrictAddressFamilies = [

     

       76
       76
       +
                   "AF_INET AF_INET6 AF_NETLINK AF_PACKET AF_RAW"

     

       77
       77
       +
                 ];

     

       78
       78
       +
                 CapabilityBoundingSet = [

     

       79
       79
       +
                   "CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SETUID CAP_SETGID CAP_CHOWN CAP_MKNOD"

     

       80
       80
       +
                 ];

     

       81
       81
       +
                 SystemCallFilter = [

     

       82
       82
       +
                   "~@aio @chown @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @pkey @privileged @raw-io @reboot @sandbox @setuid @swap @timer"

     

       83
       83
       +
                 ];

     

       84
       84
       +
                 SystemCallErrorNumber = "EPERM";

     

       51
       85
        
               };

     

       52
       86
        
               wantedBy = [ "multi-user.target" ];

     

       53
       87
        
             };