torjus/labmon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Attempt to fix module

Browse Source
This commit is contained in:
Torjus Håkestad 2025-05-24 03:20:47 +02:00
parent ed25eca79f
commit 04fd788980
Signed by: torjus
SSH Key Fingerprint: SHA256:KjAds8wHfD2mBYK2H815s/+ABcSdcIHUndwHEdSxml4
1 changed files with 41 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
nix/module.nix
View File

@ -5,9 +5,10 @@
...
}:
let
cfg = config.labmon;
settingsFormat = pkgs.format.toml { };
settingsFile = settingsFormat.generate "labmon.toml" config.labmon.settings;
settingsFile = settingsFormat.generate "labmon.toml" cfg.labmon.settings;
in
{
options.labmon = {
@ -21,45 +22,47 @@ in
};
};
systemd.services.labmon = {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
config = lib.mkIf cfg.enable {
systemd.services.labmon = {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
serviceConfig = {
ExecStart = "${pkgs.labmon}/bin/labmon ${settingsFile}";
DynamicUser = true;
Restart = "always";
serviceConfig = {
ExecStart = "${pkgs.labmon}/bin/labmon ${settingsFile}";
DynamicUser = true;
Restart = "always";
# Hardening
DevicePolicy = "strict";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full";
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
# Hardening
DevicePolicy = "strict";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full";
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
};
};
};
}