···

       
86
       
86
       
 
       
  mkService = name: keyboard: nameValuePair (mkName name) {

     

       
87
       
87
       
 
       
    wantedBy = [ "multi-user.target" ];

     

       
88
       
88
       
 
       
    serviceConfig = {

     

       
89
       
89
       
+
       
      Type = "notify";

     

       
89
       
90
       
 
       
      ExecStart = ''

     

       
90
       
91
       
 
       
        ${getExe cfg.package} \

     

       
91
       
92
       
 
       
          --cfg ${mkConfig name keyboard} \

     
···

       
123
       
124
       
 
       
      ProtectKernelModules = true;

     

       
124
       
125
       
 
       
      ProtectKernelTunables = true;

     

       
125
       
126
       
 
       
      ProtectProc = "invisible";

     

       
126
       
126
       
-
       
      RestrictAddressFamilies =

     

       
127
       
127
       
-
       
        if (keyboard.port == null) then "none" else [ "AF_INET" ];

     

       
127
       
127
       
+
       
      RestrictAddressFamilies = [ "AF_UNIX" ] ++ optional (keyboard.port != null) "AF_INET";

     

       
128
       
128
       
 
       
      RestrictNamespaces = true;

     

       
129
       
129
       
 
       
      RestrictRealtime = true;

     

       
130
       
130
       
 
       
      SystemCallArchitectures = [ "native" ];