movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

Merge #305844: add clatd module and nixos test

Browse source
This commit is contained in:
nicoo 2024-05-02 14:00:06 +00:00 • committed by GitHub
commit 480b871f2d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 278 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
nixos/modules/module-list.nix
View file

@ -946,6 +946,7 @@
./services/networking/charybdis.nix
./services/networking/chisel-server.nix
./services/networking/cjdns.nix
./services/networking/clatd.nix
./services/networking/cloudflare-dyndns.nix
./services/networking/cloudflared.nix
./services/networking/cntlm.nix

82
nixos/modules/services/networking/clatd.nix Normal file
View file

@ -0,0 +1,82 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.clatd;
settingsFormat = pkgs.formats.keyValue {};
configFile = settingsFormat.generate "clatd.conf" cfg.settings;
in
{
options = {
services.clatd = {
enable = mkEnableOption "clatd";
package = mkPackageOption pkgs "clatd" { };
settings = mkOption {
type = types.submodule ({ name, ... }: {
freeformType = settingsFormat.type;
});
default = { };
example = literalExpression ''
{
plat-prefix = "64:ff9b::/96";
}
'';
description = ''
Configuration of clatd. See [clatd Documentation](https://github.com/toreanderson/clatd/blob/master/README.pod#configuration).
'';
};
};
};
config = mkIf cfg.enable {
systemd.services.clatd = {
description = "464XLAT CLAT daemon";
documentation = [ "man:clatd(8)" ];
wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
startLimitIntervalSec = 0;
serviceConfig = {
ExecStart = "${cfg.package}/bin/clatd -c ${configFile}";
startLimitIntervalSec = 0;
# Hardening
CapabilityBoundingSet = [
"CAP_NET_ADMIN"
];
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectProc = "invisible";
ProtectSystem = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_NETLINK"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@network-io"
"@system-service"
"~@privileged"
"~@resources"
];
};
};
};
}