weewx: harden systemd service

flake.nix

@@ -170,6 +170,7 @@
 
       perSystem = { config, pkgs, inputs', ... }: {
         treefmt = {
+          package = pkgs.treefmt1;
           inherit (config.flake-root) projectRootFile;
 
           programs = {

system/hosts/adsb-antenna.nix

@@ -31,12 +31,14 @@ in
         "https://attic.cache.daniel.sx/nifoc-systems?priority=1"
         "https://attic.cache.daniel.sx/nifoc-ci?priority=2"
         "https://nix-community.cachix.org?priority=3"
+        "https://cache.garnix.io?priority=4"
       ];
 
       trusted-public-keys = [
         "nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
         "nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
       ];
     };
 

system/hosts/argon.nix

@@ -54,12 +54,14 @@ in
         "https://attic.cache.daniel.sx/nifoc-systems?priority=1"
         "https://attic.cache.daniel.sx/nifoc-ci?priority=2"
         "https://nix-community.cachix.org?priority=3"
+        "https://cache.garnix.io?priority=4"
       ];
 
       trusted-public-keys = [
         "nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
         "nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
       ];
 
       trusted-users = [

system/hosts/mediaserver.nix

@@ -64,12 +64,14 @@ in
         "https://attic.cache.daniel.sx/nifoc-systems?priority=1"
         "https://attic.cache.daniel.sx/nifoc-ci?priority=2"
         "https://nix-community.cachix.org?priority=3"
+        "https://cache.garnix.io?priority=4"
       ];
 
       trusted-public-keys = [
         "nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
         "nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
       ];
 
       trusted-users = [

system/hosts/neon.nix

@@ -42,12 +42,14 @@ in
         "https://attic.cache.daniel.sx/nifoc-systems?priority=1"
         "https://attic.cache.daniel.sx/nifoc-ci?priority=2"
         "https://nix-community.cachix.org?priority=3"
+        "https://cache.garnix.io?priority=4"
       ];
 
       trusted-public-keys = [
         "nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
         "nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
       ];
     };
 

system/nixos/weewx.nix

@@ -41,6 +41,27 @@ in
         Group = "weewx";
         ExecStart = "${pkg}/bin/weewxd --config=${config.age.secrets.weewx-config.path}";
         ExecStopPost = "-!${lib.getExe pkgs.umount} ${home}/weewx-data";
+
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
       };
     };