depot/ops/nixos/totoro/barf.nix

41 lines
1.1 KiB
Nix
Raw Normal View History

# SPDX-FileCopyrightText: 2024 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0
{ depot, pkgs, ... }:
{
systemd.targets.barf = {
wantedBy = [ "multi-user.target" ];
};
systemd.services.barf-sapid = {
wantedBy = [ "barf.target" ];
serviceConfig = {
ExecStart = "${depot.web.barf.sapi.sapid-wrapper}/bin/sapid-wrapper";
CacheDirectory = "barf-sapid";
User = "barf-sapid";
KillMode = "mixed";
PrivateTmp = true;
PrivateDevices = true;
RestrictNamespaces = true;
RestrictRealtime = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectHome = true;
ProtectProc = "invisible";
ProcSubset = "pid";
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectClock = true;
CapabilityBoundingSet = "";
LockPersonality = true;
PrivateUsers = true;
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
DynamicUser = true;
Restart = "always";
};
};
}