lukegb/depot
1
0
Fork 0
Code Issues 1 Pull requests Projects Packages Activity Actions

pomerium: unbreak LuaJIT

Browse source
This commit is contained in:
Luke Granger-Brown 2020-12-28 17:04:31 +00:00
parent d3f6442301
commit 8ed1d0665e
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
nix/pkgs/pomerium/module.nix
View file

@ -41,6 +41,7 @@ with lib;
StateDirectory = "pomerium"; StateDirectory = "pomerium";
PrivateUsers = !cfg.bindLowPort; # breaks CAP_NET_BIND_SERVICE PrivateUsers = !cfg.bindLowPort; # breaks CAP_NET_BIND_SERVICE
MemoryDenyWriteExecute = false; # breaks LuaJIT
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateTmp = true; PrivateTmp = true;
@ -56,8 +57,8 @@ with lib;
RestrictNamespaces = true; RestrictNamespaces = true;
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
MemoryDenyWriteExecute = true;
LockPersonality = true; LockPersonality = true;
SystemCallArchitectures = "native";
EnvironmentFile = cfg.secretsFile; EnvironmentFile = cfg.secretsFile;
AmbientCapabilities = lib.mkIf cfg.bindLowPort [ "CAP_NET_BIND_SERVICE" ]; AmbientCapabilities = lib.mkIf cfg.bindLowPort [ "CAP_NET_BIND_SERVICE" ];