pyrox.dev / nixpkgs
lol
fork atom

cjdns service: allow writing keys to /etc

20e81f7c0d56e0b179115ca72a85b81ff637d909 prevented key generation in
`preStart`, leaving the service broken for the case where the user has
no pre-existing key.

Eventually, we ought to store the state elsewhere so that `/etc` can be
read-only but for now we fix this the easy way.

Joachim Fasting a0338afe f9c684e1

options
unified split
Changed files
+1 -1
nixos
modules
services
networking
cjdns.nix
+1 -1
nixos/modules/services/networking/cjdns.nix 
···

       
260

       
 

       
        RestartSec = 1;


     

       
261

       
 

       
        CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";


     

       
262

       
 

       
        AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";


     

       
263

       
-

       
        ProtectSystem = "full";


     

       
264

       
 

       
        MemoryDenyWriteExecute = true;


     

       
265

       
 

       
        ProtectHome = true;


     

       
266

       
 

       
        PrivateTmp = true;


     
···

       
260

       
 

       
        RestartSec = 1;


     

       
261

       
 

       
        CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";


     

       
262

       
 

       
        AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";


     

       
263

       
+

       
        ProtectSystem = true;


     

       
264

       
 

       
        MemoryDenyWriteExecute = true;


     

       
265

       
 

       
        ProtectHome = true;


     

       
266

       
 

       
        PrivateTmp = true;