movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 06:00:33 +03:00
Code Activity

nixos/uptime-kuma: Add additional lockdown settings to systemd unit (#361452)

Browse source
This commit is contained in:
Julien Malka 2024-12-04 16:14:18 +01:00 • committed by GitHub
commit a574f2b68d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 21 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

33
nixos/modules/services/monitoring/uptime-kuma.nix
View file

@ -51,21 +51,30 @@ in
DynamicUser = true; DynamicUser = true;
ExecStart = "${cfg.package}/bin/uptime-kuma-server"; ExecStart = "${cfg.package}/bin/uptime-kuma-server";
Restart = "on-failure"; Restart = "on-failure";
ProtectHome = true; AmbientCapabilities = "";
ProtectSystem = "strict"; CapabilityBoundingSet = "";
PrivateTmp = true; LockPersonality = true;
PrivateDevices = true; MemoryDenyWriteExecute = false; # enabling it breaks execution
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "noaccess";
ProtectSystem = "strict";
RemoveIPC = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ];
RestrictNamespaces = true;
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
RemoveIPC = true; SystemCallArchitectures = "native";
PrivateMounts = true; UMask = 027;
}; };
}; };
}; };