mirror of
https://github.com/spacebarchat/server.git
synced 2026-03-30 20:25:40 +00:00
91 lines
2.5 KiB
Nix
91 lines
2.5 KiB
Nix
{
|
|
lib,
|
|
secrets,
|
|
cfg,
|
|
}:
|
|
conf:
|
|
lib.recursiveUpdate
|
|
(lib.recursiveUpdate {
|
|
documentation = [ "https://docs.spacebar.chat/" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
wants = [ "network-online.target" ];
|
|
after = [ "network-online.target" ];
|
|
environment = secrets.systemdEnvironment;
|
|
serviceConfig = {
|
|
LoadCredential = secrets.systemdLoadCredentials;
|
|
|
|
User = "spacebarchat";
|
|
Group = "spacebarchat";
|
|
DynamicUser = false;
|
|
|
|
LockPersonality = true;
|
|
NoNewPrivileges = true;
|
|
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
PrivateDevices = true;
|
|
PrivateMounts = true;
|
|
PrivateUsers = true;
|
|
RestrictAddressFamilies = [
|
|
"AF_INET"
|
|
"AF_INET6"
|
|
"AF_UNIX"
|
|
"AF_NETLINK"
|
|
];
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallFilter = [
|
|
"@system-service"
|
|
"~@privileged"
|
|
"@chown" # Required for copying files with FICLONE, apparently.
|
|
];
|
|
CapabilityBoundingSet = [
|
|
"~CAP_SYS_ADMIN"
|
|
"~CAP_AUDIT_*"
|
|
"~CAP_NET_(BIND_SERVICE|BROADCAST|RAW)"
|
|
"~CAP_NET_ADMIN" # No use for this as we don't currently use iptables for enforcing instance bans
|
|
"~CAP_SYS_TIME"
|
|
"~CAP_KILL"
|
|
"~CAP_(DAC_*|FOWNER|IPC_OWNER)"
|
|
"~CAP_LINUX_IMMUTABLE"
|
|
"~CAP_IPC_LOCK"
|
|
"~CAP_BPF"
|
|
"~CAP_SYS_TTY_CONFIG"
|
|
"~CAP_SYS_BOOT"
|
|
"~CAP_SYS_CHROOT"
|
|
"~CAP_BLOCK_SUSPEND"
|
|
"~CAP_LEASE"
|
|
"~CAP_(CHOWN|FSETID|FSETFCAP)" # Check if we need CAP_CHOWN for `fchown()` (FICLONE)?
|
|
"~CAP_SET(UID|GID|PCAP)"
|
|
"~CAP_MAC_*"
|
|
"~CAP_SYS_PTRACE"
|
|
"~CAP_SYS_(NICE|RESOURCE)"
|
|
"~CAP_SYS_RAWIO"
|
|
"~CAP_SYSLOG"
|
|
];
|
|
RestrictSUIDSGID = true;
|
|
|
|
WorkingDirectory = "/var/lib/spacebar";
|
|
StateDirectory = "spacebar";
|
|
StateDirectoryMode = "0750";
|
|
RuntimeDirectory = "spacebar";
|
|
RuntimeDirectoryMode = "0750";
|
|
RuntimeDirectoryPreserve = "yes";
|
|
ReadWritePaths = [ cfg.cdnPath ];
|
|
NoExecPaths = [ cfg.cdnPath ];
|
|
|
|
Restart = "on-failure";
|
|
RestartSec = 10;
|
|
StartLimitBurst = 5;
|
|
UMask = "077";
|
|
}
|
|
// lib.optionalAttrs (cfg.databaseFile != null) { EnvironmentFile = cfg.databaseFile; };
|
|
} conf)
|
|
{
|
|
}
|