diff options
author | Mx Kookie <kookie@spacekookie.de> | 2020-12-09 18:55:19 +0000 |
---|---|---|
committer | Mx Kookie <kookie@spacekookie.de> | 2020-12-09 18:55:19 +0000 |
commit | 80d90d9b204f7c17912740f9f414fe5d59f293ba (patch) | |
tree | 5f2065a06e724270610760d59d01c6888b375a46 /infra/libkookie/nixpkgs/nixos/modules/services/web-apps/shiori.nix | |
parent | 3a31a84c7d3e589035ad08499206aac44a81f424 (diff) | |
parent | 83cbad92d73216bb0d9187c56cce0b91f9121d5a (diff) |
Merge commit '83cbad92d73216bb0d9187c56cce0b91f9121d5a' into main
Diffstat (limited to 'infra/libkookie/nixpkgs/nixos/modules/services/web-apps/shiori.nix')
-rw-r--r-- | infra/libkookie/nixpkgs/nixos/modules/services/web-apps/shiori.nix | 51 |
1 files changed, 50 insertions, 1 deletions
diff --git a/infra/libkookie/nixpkgs/nixos/modules/services/web-apps/shiori.nix b/infra/libkookie/nixpkgs/nixos/modules/services/web-apps/shiori.nix index 1817a2039352..9083ddfa2206 100644 --- a/infra/libkookie/nixpkgs/nixos/modules/services/web-apps/shiori.nix +++ b/infra/libkookie/nixpkgs/nixos/modules/services/web-apps/shiori.nix @@ -37,11 +37,60 @@ in { description = "Shiori simple bookmarks manager"; wantedBy = [ "multi-user.target" ]; + environment.SHIORI_DIR = "/var/lib/shiori"; + serviceConfig = { ExecStart = "${package}/bin/shiori serve --address '${address}' --port '${toString port}'"; + DynamicUser = true; - Environment = "SHIORI_DIR=/var/lib/shiori"; StateDirectory = "shiori"; + # As the RootDirectory + RuntimeDirectory = "shiori"; + + # Security options + + BindReadOnlyPaths = [ + "/nix/store" + + # For SSL certificates, and the resolv.conf + "/etc" + ]; + + CapabilityBoundingSet = ""; + + DeviceAllow = ""; + + LockPersonality = true; + + MemoryDenyWriteExecute = true; + + PrivateDevices = true; + PrivateUsers = true; + + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + + RestrictNamespaces = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + RestrictRealtime = true; + RestrictSUIDSGID = true; + + RootDirectory = "/run/shiori"; + + SystemCallArchitectures = "native"; + SystemCallErrorNumber = "EPERM"; + SystemCallFilter = [ + "@system-service" + + "~@chown" "~@cpu-emulation" "~@debug" "~@ipc" "~@keyring" "~@memlock" + "~@module" "~@obsolete" "~@privileged" "~@process" "~@raw-io" + "~@resources" "~@setuid" + ]; }; }; }; |