movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 06:00:33 +03:00
Code Activity

blocky: bugfix, add systemd hardening, log, adjust: startup targets (#388962)

Browse source
This commit is contained in:
Pol Dellaiera 2025-03-27 21:46:59 +01:00 • committed by GitHub
commit 952001e9bb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 46 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

52
nixos/modules/services/networking/blocky.nix
View file

@ -30,16 +30,56 @@ in
config = lib.mkIf cfg.enable {
systemd.services.blocky = {
description = "A DNS proxy and ad-blocker for the local network";
wantedBy = [ "multi-user.target" ];
wants = [
"network-online.target"
"nss-lookup.target"
];
before = [
"nss-lookup.target"
];
wantedBy = [
"multi-user.target"
];
serviceConfig = {
DynamicUser = true;
ExecStart = "${lib.getExe cfg.package} --config ${configFile}";
Restart = "on-failure";
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
DynamicUser = true;
ExecStart = "${lib.getExe cfg.package} --config ${configFile}";
LockPersonality = true;
LogsDirectory = "blocky";
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
NonBlocking = true;
PrivateDevices = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
Restart = "on-failure";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RuntimeDirectory = "blocky";
StateDirectory = "blocky";
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"@chown"
"~@aio"
"~@keyring"
"~@memlock"
"~@setuid"
"~@timer"
];
};
};
};
meta.maintainers = with lib.maintainers; [ paepcke ];
}