daniel/dotfiles
1
0
Fork 0
Code Activity Actions

anonymous-overflow: Simplify systemd config

Browse source
This commit is contained in:
Daniel Kempkens 2023-02-15 20:50:43 +01:00
parent eff449c44c
commit 8604b828fc
Signed by: daniel
SSH key fingerprint: SHA256:Ks/MyhQYcPRQiwMKLAKquWCdCPe3JXlb1WttgnAoSeM
1 changed files with 0 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
system/nixos/anonymous-overflow.nix
View file

@ -12,34 +12,9 @@ in
DynamicUser = true; DynamicUser = true;
StateDirectory = "anonymous-overflow"; StateDirectory = "anonymous-overflow";
EnvironmentFile = [ config.age.secrets.anonymous-overflow-config.path ]; EnvironmentFile = [ config.age.secrets.anonymous-overflow-config.path ];
# Some parts of Nitter expect `public` folder in working directory,
# see https://github.com/zedeus/nitter/issues/414
ExecStart = "${anonymous-overflow-pkg}/bin/anonymousoverflow"; ExecStart = "${anonymous-overflow-pkg}/bin/anonymousoverflow";
Restart = "on-failure"; Restart = "on-failure";
RestartSec = "5s"; RestartSec = "5s";
# Hardening
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
UMask = "0077";
}; };
}; };