@ -40,39 +40,64 @@ in
'' ;
} ;
systemd . services . pinnwand = {
description = " P i n n w a n n d H T T P S e r v e r " ;
after = [ " n e t w o r k . t a r g e t " ] ;
wantedBy = [ " m u l t i - u s e r . t a r g e t " ] ;
systemd . services = let
hardeningOptions = {
User = " p i n n w a n d " ;
DynamicUser = true ;
unitConfig . Documentation = " h t t p s : / / p i n n w a n d . r e a d t h e d o c s . i o / e n / l a t e s t / " ;
serviceConfig = {
ExecStart = " ${ pkgs . pinnwand } / b i n / p i n n w a n d - - c o n f i g u r a t i o n - p a t h ${ configFile } h t t p - - p o r t ${ toString ( cfg . port ) } " ;
StateDirectory = " p i n n w a n d " ;
StateDirectoryMode = " 0 7 0 0 " ;
AmbientCapabilities = [ ] ;
CapabilityBoundingSet = " " ;
DevicePolicy = " c l o s e d " ;
DynamicUser = true ;
LockPersonality = true ;
MemoryDenyWriteExecute = true ;
PrivateDevices = true ;
PrivateUsers = true ;
ProcSubset = " p i d " ;
ProtectClock = true ;
ProtectControlGroups = true ;
ProtectKernelLogs = true ;
ProtectHome = true ;
ProtectHostname = true ;
ProtectKernelLogs = true ;
ProtectKernelModules = true ;
ProtectKernelTunables = true ;
RestrictAddressFamilies = [ " A F _ U N I X " " A F _ I N E T " " A F _ I N E T 6 " ] ;
ProtectProc = " i n v i s i b l e " ;
RestrictAddressFamilies = [
" A F _ U N I X "
" A F _ I N E T "
" A F _ I N E T 6 "
] ;
RestrictNamespaces = true ;
RestrictRealtime = true ;
SystemCallArchitectures = " n a t i v e " ;
SystemCallFilter = " @ s y s t e m - s e r v i c e " ;
UMask = " 0 0 7 7 " ;
} ;
command = " ${ pkgs . pinnwand } / b i n / p i n n w a n d - - c o n f i g u r a t i o n - p a t h ${ configFile } " ;
in {
pinnwand = {
description = " P i n n w a n n d H T T P S e r v e r " ;
after = [ " n e t w o r k . t a r g e t " ] ;
wantedBy = [ " m u l t i - u s e r . t a r g e t " ] ;
unitConfig . Documentation = " h t t p s : / / p i n n w a n d . r e a d t h e d o c s . i o / e n / l a t e s t / " ;
serviceConfig = {
ExecStart = " ${ command } h t t p - - p o r t ${ toString ( cfg . port ) } " ;
} // hardeningOptions ;
} ;
pinnwand-reaper = {
description = " P i n n w a n d R e a p e r " ;
startAt = " d a i l y " ;
serviceConfig = {
ExecStart = " ${ command } - v v v v r e a p " ; # verbosity increased to show number of deleted pastes
} // hardeningOptions ;
} ;
} ;
} ;
}