···

       
45
       
45
       
 
       
      }

     

       
46
       
46
       
 
       
      // (optionalAttrs (cfg'.user == null) {

     

       
47
       
47
       
 
       
        DynamicUser = true;

     

       
48
       
48
       
+
       
        ProtectHome = true;

     

       
48
       
49
       
 
       
      })

     

       
49
       
50
       
 
       
      // (optionalAttrs (cfg'.additionalGroups != [ ]) {

     

       
50
       
51
       
 
       
        SupplementaryGroups = cfg'.additionalGroups;

     
···

       
63
       
64
       
 
       
      PrivateTmp = true;

     

       
64
       
65
       
 
       
      NoNewPrivileges = true;

     

       
65
       
66
       
 
       
      ProtectSystem = "strict";

     

       
66
       
66
       
-
       
      ProtectHome = true;

     

       
67
       
67
       
 
       
      ProtectKernelTunables = true;

     

       
68
       
68
       
 
       
      ProtectKernelModules = true;

     

       
69
       
69
       
 
       
      ProtectControlGroups = true;

     

···

       
217
       
217
       
 
       
          };

     

       
218
       
218
       
 
       
        };

     

       
219
       
219
       
 
       


     

       
220
       
220
       
-
       
        # ProtectHome is the default, but we must access our storage

     

       
221
       
221
       
-
       
        # in ~.

     

       
222
       
222
       
-
       
        systemd.services = {

     

       
223
       
223
       
-
       
          "vdirsyncer@alice".serviceConfig.ProtectHome = lib.mkForce false;

     

       
224
       
224
       
-
       
          "vdirsyncer@bob".serviceConfig.ProtectHome = lib.mkForce false;

     

       
225
       
225
       
-
       
        };

     

       
226
       
226
       
-
       


     

       
227
       
220
       
 
       
        users.users = {

     

       
228
       
221
       
 
       
          alice.isNormalUser = true;

     

       
229
       
222
       
 
       
          bob.isNormalUser = true;