···

       
48
       
 
       
      wantedBy = [

     

       
49
       
 
       
        "multi-user.target"

     

       
50
       
 
       
      ];

     

       
51
       
-
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
52
       
 
       
      serviceConfig = {

     

       
53
       
 
       
        ExecStart = "${package}/bin/evcc --config ${configFile} ${escapeShellArgs cfg.extraArgs}";

     

       
54
       
 
       
        CapabilityBoundingSet = [ "" ];

     
···

       
77
       
 
       
        ProtectKernelModules = true;

     

       
78
       
 
       
        ProtectKernelTunables = true;

     

       
79
       
 
       
        ProtectProc = "invisible";

     

       
0
       
 
       

     

       
80
       
 
       
        SystemCallArchitectures = "native";

     

       
81
       
 
       
        SystemCallFilter = [

     

       
82
       
 
       
          "@system-service"

     

···

       
48
       
 
       
      wantedBy = [

     

       
49
       
 
       
        "multi-user.target"

     

       
50
       
 
       
      ];

     

       
51
       
+
       
      environment.HOME = "/var/lib/evcc";

     

       
52
       
+
       
      path = with pkgs; [

     

       
53
       
+
       
        glibc # requires getent

     

       
54
       
+
       
      ];

     

       
55
       
 
       
      serviceConfig = {

     

       
56
       
 
       
        ExecStart = "${package}/bin/evcc --config ${configFile} ${escapeShellArgs cfg.extraArgs}";

     

       
57
       
 
       
        CapabilityBoundingSet = [ "" ];

     
···

       
80
       
 
       
        ProtectKernelModules = true;

     

       
81
       
 
       
        ProtectKernelTunables = true;

     

       
82
       
 
       
        ProtectProc = "invisible";

     

       
83
       
+
       
        StateDirectory = "evcc";

     

       
84
       
 
       
        SystemCallArchitectures = "native";

     

       
85
       
 
       
        SystemCallFilter = [

     

       
86
       
 
       
          "@system-service"