commit 35693b3279b4e70bdd611f49b38b78e4d0b93deb · pyrox.dev/nixpkgs

+27
nixos/modules/services/admin/pgadmin.nix
···

       228
       228
        
                 "initial_password:${cfg.initialPasswordFile}"

     

       229
       229
        
               ]

     

       230
       230
        
               ++ lib.optional cfg.emailServer.enable "email_password:${cfg.emailServer.passwordFile}";

     

       231
       231
       +
               AmbientCapabilities = "";

     

       232
       232
       +
               CapabilityBoundingSet = "";

     

       233
       233
       +
               LockPersonality = true;

     

       234
       234
       +
               MemoryDenyWriteExecute = true;

     

       235
       235
       +
               NoNewPrivileges = true;

     

       236
       236
       +
               PrivateDevices = true;

     

       237
       237
       +
               PrivateMounts = true;

     

       238
       238
       +
               PrivateTmp = true;

     

       239
       239
       +
               ProtectClock = true;

     

       240
       240
       +
               ProtectControlGroups = true;

     

       241
       241
       +
               ProtectHome = true;

     

       242
       242
       +
               ProtectHostname = true;

     

       243
       243
       +
               ProtectKernelLogs = true;

     

       244
       244
       +
               ProtectKernelModules = true;

     

       245
       245
       +
               ProtectKernelTunables = true;

     

       246
       246
       +
               ProtectSystem = "full";

     

       247
       247
       +
               RemoveIPC = true;

     

       248
       248
       +
               RestrictAddressFamilies = [

     

       249
       249
       +
                 "AF_UNIX"

     

       250
       250
       +
                 "AF_INET"

     

       251
       251
       +
                 "AF_INET6"

     

       252
       252
       +
               ];

     

       253
       253
       +
               RestrictNamespaces = true;

     

       254
       254
       +
               RestrictRealtime = true;

     

       255
       255
       +
               RestrictSUIDSGID = true;

     

       256
       256
       +
               SystemCallArchitectures = "native";

     

       257
       257
       +
               UMask = 27;

     

       231
       258
        
             };

     

       232
       259
        
           };

     

       233
       260