demostf/sync-rs
1
0
Fork 0
mirror of https://codeberg.org/demostf/sync.git synced 2026-06-03 16:44:07 +02:00
Code Issues Releases Wiki Activity

socket permissions

Browse source
This commit is contained in:
Robin Appelman 2025-05-10 15:59:12 +02:00
commit 74df62fe9c
2 changed files with 13 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nix/module.nix
View file

@ -21,6 +21,12 @@ in {
};
config = lib.mkIf cfg.enable {
users.users.demostf-sync = {
group = "demostf-sync";
isSystemUser = true;
};
users.groups.demostf-sync = {};
systemd.services.demostf-sync = {
wantedBy = ["multi-user.target"];
environment = {
@ -28,7 +34,7 @@ in {
};
serviceConfig = {
DynamicUser = true;
User = "demostf-sync";
ExecStart = "${cfg.package}/bin/sync";
Restart = "on-failure";
@ -55,9 +61,11 @@ in {
ProcSubset = "pid";
ProtectProc = "invisible";
SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];
UMask = "0007";
UMask = "0077";
IPAddressDeny = "any";
RuntimeDirectory = "demostf-sync";
RestrictSUIDSGID = true;
RemoveIPC = true;
};
};
};