···

       
804
       
804
       
 
       
        ProtectControlGroups = true;

     

       
805
       
805
       
 
       
        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];

     

       
806
       
806
       
 
       
        LockPersonality = true;

     

       
807
       
807
       
-
       
        MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) pkgs.nginx.modules);

     

       
807
       
807
       
+
       
        MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules);

     

       
808
       
808
       
 
       
        RestrictRealtime = true;

     

       
809
       
809
       
 
       
        RestrictSUIDSGID = true;

     

       
810
       
810
       
 
       
        PrivateMounts = true;