commit fae4917f2f72fa00cf0c4e34d2507c5b96a2f6bb · pyrox.dev/nixpkgs

+39 -1

nixos/modules/services/misc/homepage-dashboard.nix

···

       232
        
       

     

       233
        
             serviceConfig = {

     

       234
        
               Type = "simple";

     

       235
       -
               DynamicUser = true;

     

       236
        
               EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;

     

       237
        
               StateDirectory = "homepage-dashboard";

     

       238
        
               CacheDirectory = "homepage-dashboard";

     

       239
        
               ExecStart = lib.getExe cfg.package;

     

       240
        
               Restart = "on-failure";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       241
        
             };

     

       242
        
       

     

       243
        
             enableStrictShellChecks = true;

···

       232
        
       

     

       233
        
             serviceConfig = {

     

       234
        
               Type = "simple";

     

       0
        
       
     

       235
        
               EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;

     

       236
        
               StateDirectory = "homepage-dashboard";

     

       237
        
               CacheDirectory = "homepage-dashboard";

     

       238
        
               ExecStart = lib.getExe cfg.package;

     

       239
        
               Restart = "on-failure";

     

       240
       +
       

     

       241
       +
               # hardening

     

       242
       +
               DynamicUser = true;

     

       243
       +
               DevicePolicy = "closed";

     

       244
       +
               CapabilityBoundingSet = "";

     

       245
       +
               RestrictAddressFamilies = [

     

       246
       +
                 "AF_INET"

     

       247
       +
                 "AF_INET6"

     

       248
       +
                 "AF_UNIX"

     

       249
       +
                 "AF_NETLINK"

     

       250
       +
               ];

     

       251
       +
               DeviceAllow = "";

     

       252
       +
               NoNewPrivileges = true;

     

       253
       +
               PrivateDevices = true;

     

       254
       +
               PrivateMounts = true;

     

       255
       +
               PrivateTmp = true;

     

       256
       +
               PrivateUsers = true;

     

       257
       +
               ProtectClock = true;

     

       258
       +
               ProtectControlGroups = true;

     

       259
       +
               ProtectHome = true;

     

       260
       +
               ProtectKernelLogs = true;

     

       261
       +
               ProtectKernelModules = true;

     

       262
       +
               ProtectKernelTunables = true;

     

       263
       +
               ProtectSystem = "strict";

     

       264
       +
               LockPersonality = true;

     

       265
       +
               RemoveIPC = true;

     

       266
       +
               RestrictNamespaces = true;

     

       267
       +
               RestrictRealtime = true;

     

       268
       +
               RestrictSUIDSGID = true;

     

       269
       +
               SystemCallArchitectures = "native";

     

       270
       +
               SystemCallFilter = [

     

       271
       +
                 "@system-service"

     

       272
       +
                 "~@resources"

     

       273
       +
               ];

     

       274
       +
               ProtectProc = "invisible";

     

       275
       +
               ProtectHostname = true;

     

       276
       +
               UMask = "0077";

     

       277
       +
               # cpu widget requires access to /proc

     

       278
       +
               ProcSubset = if lib.any (widget: widget.resources.cpu or false) cfg.widgets then "all" else "pid";

     

       279
        
             };

     

       280
        
       

     

       281
        
             enableStrictShellChecks = true;