1
0
Fork 0

Compare commits

...

2 commits

Author SHA1 Message Date
3c3dd10fca
weewx: harden systemd service 2024-07-03 21:24:35 +02:00
a27dd3c3dd
all: add garnix cache 2024-07-03 14:40:31 +02:00
6 changed files with 30 additions and 0 deletions

View file

@ -170,6 +170,7 @@
perSystem = { config, pkgs, inputs', ... }: { perSystem = { config, pkgs, inputs', ... }: {
treefmt = { treefmt = {
package = pkgs.treefmt1;
inherit (config.flake-root) projectRootFile; inherit (config.flake-root) projectRootFile;
programs = { programs = {

View file

@ -31,12 +31,14 @@ in
"https://attic.cache.daniel.sx/nifoc-systems?priority=1" "https://attic.cache.daniel.sx/nifoc-systems?priority=1"
"https://attic.cache.daniel.sx/nifoc-ci?priority=2" "https://attic.cache.daniel.sx/nifoc-ci?priority=2"
"https://nix-community.cachix.org?priority=3" "https://nix-community.cachix.org?priority=3"
"https://cache.garnix.io?priority=4"
]; ];
trusted-public-keys = [ trusted-public-keys = [
"nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU=" "nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
"nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk=" "nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
]; ];
}; };

View file

@ -54,12 +54,14 @@ in
"https://attic.cache.daniel.sx/nifoc-systems?priority=1" "https://attic.cache.daniel.sx/nifoc-systems?priority=1"
"https://attic.cache.daniel.sx/nifoc-ci?priority=2" "https://attic.cache.daniel.sx/nifoc-ci?priority=2"
"https://nix-community.cachix.org?priority=3" "https://nix-community.cachix.org?priority=3"
"https://cache.garnix.io?priority=4"
]; ];
trusted-public-keys = [ trusted-public-keys = [
"nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU=" "nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
"nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk=" "nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
]; ];
trusted-users = [ trusted-users = [

View file

@ -64,12 +64,14 @@ in
"https://attic.cache.daniel.sx/nifoc-systems?priority=1" "https://attic.cache.daniel.sx/nifoc-systems?priority=1"
"https://attic.cache.daniel.sx/nifoc-ci?priority=2" "https://attic.cache.daniel.sx/nifoc-ci?priority=2"
"https://nix-community.cachix.org?priority=3" "https://nix-community.cachix.org?priority=3"
"https://cache.garnix.io?priority=4"
]; ];
trusted-public-keys = [ trusted-public-keys = [
"nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU=" "nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
"nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk=" "nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
]; ];
trusted-users = [ trusted-users = [

View file

@ -42,12 +42,14 @@ in
"https://attic.cache.daniel.sx/nifoc-systems?priority=1" "https://attic.cache.daniel.sx/nifoc-systems?priority=1"
"https://attic.cache.daniel.sx/nifoc-ci?priority=2" "https://attic.cache.daniel.sx/nifoc-ci?priority=2"
"https://nix-community.cachix.org?priority=3" "https://nix-community.cachix.org?priority=3"
"https://cache.garnix.io?priority=4"
]; ];
trusted-public-keys = [ trusted-public-keys = [
"nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU=" "nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
"nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk=" "nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
]; ];
}; };

View file

@ -41,6 +41,27 @@ in
Group = "weewx"; Group = "weewx";
ExecStart = "${pkg}/bin/weewxd --config=${config.age.secrets.weewx-config.path}"; ExecStart = "${pkg}/bin/weewxd --config=${config.age.secrets.weewx-config.path}";
ExecStopPost = "-!${lib.getExe pkgs.umount} ${home}/weewx-data"; ExecStopPost = "-!${lib.getExe pkgs.umount} ${home}/weewx-data";
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
}; };
}; };