commit 9b0a9577f78fc8fc619cd75cc87cfe8e1c39b7b9 · pyrox.dev/nixpkgs

+22 -1
nixos/modules/services/misc/parsoid.nix
···

       98
       98
        
             wantedBy = [ "multi-user.target" ];

     

       99
       99
        
             after = [ "network.target" ];

     

       100
       100
        
             serviceConfig = {

     

       101
       101
       -
               User = "nobody";

     

       102
       101
        
               ExecStart = "${parsoid}/lib/node_modules/parsoid/bin/server.js -c ${confFile} -n ${toString cfg.workers}";

     

       102
       102
       +
       

     

       103
       103
       +
               DynamicUser = true;

     

       104
       104
       +
               User = "parsoid";

     

       105
       105
       +
               Group = "parsoid";

     

       106
       106
       +
       

     

       107
       107
       +
               CapabilityBoundingSet = "";

     

       108
       108
       +
               NoNewPrivileges = true;

     

       109
       109
       +
               ProtectSystem = "strict";

     

       110
       110
       +
               ProtectHome = true;

     

       111
       111
       +
               PrivateTmp = true;

     

       112
       112
       +
               PrivateDevices = true;

     

       113
       113
       +
               ProtectHostname = true;

     

       114
       114
       +
               ProtectKernelTunables = true;

     

       115
       115
       +
               ProtectKernelModules = true;

     

       116
       116
       +
               ProtectControlGroups = true;

     

       117
       117
       +
               RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];

     

       118
       118
       +
               RestrictNamespaces = true;

     

       119
       119
       +
               LockPersonality = true;

     

       120
       120
       +
               #MemoryDenyWriteExecute = true;

     

       121
       121
       +
               RestrictRealtime = true;

     

       122
       122
       +
               RestrictSUIDSGID = true;

     

       123
       123
       +
               RemoveIPC = true;

     

       103
       124
        
             };

     

       104
       125
        
           };

     

       105
       126