commit 5420ae11ea6a0925e2b6a9e1155a96531e789ab6 · pyrox.dev/nixpkgs

+38
nixos/modules/services/web-servers/minio.nix
···

       135
       135
        
                       (legacyCredentials cfg)

     

       136
       136
        
                     else

     

       137
       137
        
                       null;

     

       138
       138
       +
       

     

       139
       139
       +
                   # hardening

     

       140
       140
       +
                   DevicePolicy = "closed";

     

       141
       141
       +
                   CapabilityBoundingSet = "";

     

       142
       142
       +
                   RestrictAddressFamilies = [

     

       143
       143
       +
                     "AF_INET"

     

       144
       144
       +
                     "AF_INET6"

     

       145
       145
       +
                     "AF_NETLINK"

     

       146
       146
       +
                     "AF_UNIX"

     

       147
       147
       +
                   ];

     

       148
       148
       +
                   DeviceAllow = "";

     

       149
       149
       +
                   NoNewPrivileges = true;

     

       150
       150
       +
                   PrivateDevices = true;

     

       151
       151
       +
                   PrivateMounts = true;

     

       152
       152
       +
                   PrivateTmp = true;

     

       153
       153
       +
                   PrivateUsers = true;

     

       154
       154
       +
                   ProtectClock = true;

     

       155
       155
       +
                   ProtectControlGroups = true;

     

       156
       156
       +
                   ProtectHome = true;

     

       157
       157
       +
                   ProtectKernelLogs = true;

     

       158
       158
       +
                   ProtectKernelModules = true;

     

       159
       159
       +
                   ProtectKernelTunables = true;

     

       160
       160
       +
                   MemoryDenyWriteExecute = true;

     

       161
       161
       +
                   LockPersonality = true;

     

       162
       162
       +
                   RemoveIPC = true;

     

       163
       163
       +
                   RestrictNamespaces = true;

     

       164
       164
       +
                   RestrictRealtime = true;

     

       165
       165
       +
                   RestrictSUIDSGID = true;

     

       166
       166
       +
                   SystemCallArchitectures = "native";

     

       167
       167
       +
                   SystemCallFilter = [

     

       168
       168
       +
                     "@system-service"

     

       169
       169
       +
                     "~@privileged"

     

       170
       170
       +
                   ];

     

       171
       171
       +
                   ProtectProc = "invisible";

     

       172
       172
       +
                   ProtectHostname = true;

     

       173
       173
       +
                   UMask = "0077";

     

       174
       174
       +
                   # minio opens /proc/mounts on startup

     

       175
       175
       +
                   ProcSubset = "all";

     

       138
       176
        
                 };

     

       139
       177
        
                 environment = {

     

       140
       178
        
                   MINIO_REGION = "${cfg.region}";