···

       
84
       
84
       
 
       
          ++ filter (x: x != null) [

     

       
85
       
85
       
 
       
            cfg.${proto}.cert or null

     

       
86
       
86
       
 
       
            cfg.${proto}.key or null

     

       
87
       
87
       
-
       
          ]

     

       
88
       
88
       
-
       
          ++

     

       
89
       
89
       
-
       
            # Without confinement the whole Nix store

     

       
90
       
90
       
-
       
            # is made available to the service

     

       
91
       
91
       
-
       
            optionals (!config.systemd.services."public-inbox-${srv}".confinement.enable) [

     

       
92
       
92
       
-
       
              "${pkgs.dash}/bin/dash:/bin/sh"

     

       
93
       
93
       
-
       
              builtins.storeDir

     

       
94
       
94
       
-
       
            ];

     

       
87
       
87
       
+
       
          ];

     

       
95
       
88
       
 
       
        # The following options are only for optimizing:

     

       
96
       
89
       
 
       
        # systemd-analyze security public-inbox-'*'

     

       
97
       
90
       
 
       
        AmbientCapabilities = "";

     
···

       
108
       
101
       
 
       
        ProtectHostname = true;

     

       
109
       
102
       
 
       
        ProtectKernelLogs = true;

     

       
110
       
103
       
 
       
        ProtectProc = "invisible";

     

       
111
       
111
       
-
       
        #ProtectSystem = "strict";

     

       
104
       
104
       
+
       
        ProtectSystem = "strict";

     

       
112
       
105
       
 
       
        RemoveIPC = true;

     

       
113
       
106
       
 
       
        RestrictAddressFamilies =

     

       
114
       
107
       
 
       
          [ "AF_UNIX" ]

     
···

       
130
       
123
       
 
       
          # Not removing @timer because git upload-pack needs it.

     

       
131
       
124
       
 
       
        ];

     

       
132
       
125
       
 
       
        SystemCallArchitectures = "native";

     

       
133
       
133
       
-
       


     

       
134
       
134
       
-
       
        # The following options are redundant when confinement is enabled

     

       
135
       
135
       
-
       
        RootDirectory = "/var/empty";

     

       
136
       
136
       
-
       
        TemporaryFileSystem = "/";

     

       
137
       
137
       
-
       
        PrivateMounts = true;

     

       
138
       
138
       
-
       
        MountAPIVFS = true;

     

       
139
       
139
       
-
       
        PrivateDevices = true;

     

       
140
       
140
       
-
       
        PrivateTmp = true;

     

       
141
       
141
       
-
       
        PrivateUsers = true;

     

       
142
       
142
       
-
       
        ProtectControlGroups = true;

     

       
143
       
143
       
-
       
        ProtectKernelModules = true;

     

       
144
       
144
       
-
       
        ProtectKernelTunables = true;

     

       
145
       
126
       
 
       
      };

     

       
146
       
127
       
 
       
      confinement = {

     

       
147
       
147
       
-
       
        # Until we agree upon doing it directly here in NixOS

     

       
148
       
148
       
-
       
        # https://github.com/NixOS/nixpkgs/pull/104457#issuecomment-1115768447

     

       
149
       
149
       
-
       
        # let the user choose to enable the confinement with:

     

       
150
       
150
       
-
       
        # systemd.services.public-inbox-httpd.confinement.enable = true;

     

       
151
       
151
       
-
       
        # systemd.services.public-inbox-imapd.confinement.enable = true;

     

       
152
       
152
       
-
       
        # systemd.services.public-inbox-init.confinement.enable = true;

     

       
153
       
153
       
-
       
        # systemd.services.public-inbox-nntpd.confinement.enable = true;

     

       
154
       
154
       
-
       
        #enable = true;

     

       
128
       
128
       
+
       
        enable = true;

     

       
155
       
129
       
 
       
        mode = "full-apivfs";

     

       
156
       
130
       
 
       
        # Inline::C needs a /bin/sh, and dash is enough

     

       
157
       
131
       
 
       
        binSh = "${pkgs.dash}/bin/dash";