|
|
|
@ -312,6 +312,31 @@ in |
|
|
|
|
AmbientCapabilities = lib.mkIf (cfg.server.port < 1024) [ "CAP_NET_BIND_SERVICE" ]; |
|
|
|
|
Restart = "on-failure"; |
|
|
|
|
RestartSec = "5s"; |
|
|
|
|
# Hardening |
|
|
|
|
CapabilityBoundingSet = if (cfg.server.port < 1024) then [ "CAP_NET_BIND_SERVICE" ] else [ "" ]; |
|
|
|
|
DeviceAllow = [ "" ]; |
|
|
|
|
LockPersonality = true; |
|
|
|
|
MemoryDenyWriteExecute = true; |
|
|
|
|
PrivateDevices = true; |
|
|
|
|
# A private user cannot have process capabilities on the host's user |
|
|
|
|
# namespace and thus CAP_NET_BIND_SERVICE has no effect. |
|
|
|
|
PrivateUsers = (cfg.server.port >= 1024); |
|
|
|
|
ProcSubset = "pid"; |
|
|
|
|
ProtectClock = true; |
|
|
|
|
ProtectControlGroups = true; |
|
|
|
|
ProtectHome = true; |
|
|
|
|
ProtectHostname = true; |
|
|
|
|
ProtectKernelLogs = true; |
|
|
|
|
ProtectKernelModules = true; |
|
|
|
|
ProtectKernelTunables = true; |
|
|
|
|
ProtectProc = "invisible"; |
|
|
|
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; |
|
|
|
|
RestrictNamespaces = true; |
|
|
|
|
RestrictRealtime = true; |
|
|
|
|
RestrictSUIDSGID = true; |
|
|
|
|
SystemCallArchitectures = "native"; |
|
|
|
|
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ]; |
|
|
|
|
UMask = "0077"; |
|
|
|
|
}; |
|
|
|
|
}; |
|
|
|
|
|
|
|
|
|