commit c7968cf14075c62330b09bfa61e9d8a93da3b984 · pyrox.dev/nixpkgs

+8 -1
nixos/modules/services/web-apps/wakapi.nix
···

       159
       159
        
               Group = config.users.users.wakapi.group;

     

       160
       160
        
       

     

       161
       161
        
               DynamicUser = true;

     

       162
       162
       +
               PrivateTmp = true;

     

       163
       163
       +
               PrivateUsers = true;

     

       164
       164
       +
               PrivateDevices = true;

     

       162
       165
        
               ProtectHome = true;

     

       163
       166
        
               ProtectHostname = true;

     

       167
       167
       +
               ProtectClock = true;

     

       164
       168
        
               ProtectKernelLogs = true;

     

       165
       169
        
               ProtectKernelModules = true;

     

       166
       170
        
               ProtectKernelTunables = true;

     

       171
       171
       +
               ProtectControlGroups = true;

     

       172
       172
       +
               NoNewPrivileges = true;

     

       167
       173
        
               ProtectProc = "invisible";

     

       168
       168
       -
               ProtectSystem = "strict";

     

       174
       174
       +
               ProtectSystem = "full";

     

       169
       175
        
               RestrictAddressFamilies = [

     

       170
       176
        
                 "AF_INET"

     

       171
       177
        
                 "AF_INET6"

     

       172
       178
        
                 "AF_UNIX"

     

       173
       179
        
               ];

     

       180
       180
       +
               CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";

     

       174
       181
        
               RestrictNamespaces = true;

     

       175
       182
        
               RestrictRealtime = true;

     

       176
       183
        
               RestrictSUIDSGID = true;