blob: dd930c9b254c79f83bebb00599d88edebe69b80b (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
{
lib,
cfg
}:
let
secrets = import ./secrets.nix { inherit lib cfg; };
in
conf:
lib.recursiveUpdate
(lib.recursiveUpdate {
documentation = [ "https://docs.spacebar.chat/" ];
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
environment = secrets.systemdEnvironment;
serviceConfig = {
LoadCredential = secrets.systemdLoadCredentials;
User = "spacebarchat";
Group = "spacebarchat";
DynamicUser = false;
LockPersonality = true;
NoNewPrivileges = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateUsers = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
"AF_NETLINK"
];
RestrictNamespaces = true;
RestrictRealtime = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"@chown" # Required for copying files with FICLONE, apparently.
];
CapabilityBoundingSet = [
"~CAP_SYS_ADMIN"
"~CAP_AUDIT_*"
"~CAP_NET_(BIND_SERVICE|BROADCAST|RAW)"
"~CAP_NET_ADMIN" # No use for this as we don't currently use iptables for enforcing instance bans
"~CAP_SYS_TIME"
"~CAP_KILL"
"~CAP_(DAC_*|FOWNER|IPC_OWNER)"
"~CAP_LINUX_IMMUTABLE"
"~CAP_IPC_LOCK"
"~CAP_BPF"
"~CAP_SYS_TTY_CONFIG"
"~CAP_SYS_BOOT"
"~CAP_SYS_CHROOT"
"~CAP_BLOCK_SUSPEND"
"~CAP_LEASE"
"~CAP_(CHOWN|FSETID|FSETFCAP)" # Check if we need CAP_CHOWN for `fchown()` (FICLONE)?
"~CAP_SET(UID|GID|PCAP)"
"~CAP_MAC_*"
"~CAP_SYS_PTRACE"
"~CAP_SYS_(NICE|RESOURCE)"
"~CAP_SYS_RAWIO"
"~CAP_SYSLOG"
];
RestrictSUIDSGID = true;
WorkingDirectory = "/var/lib/spacebar";
StateDirectory = "spacebar";
StateDirectoryMode = "0750";
RuntimeDirectory = "spacebar";
RuntimeDirectoryMode = "0750";
RuntimeDirectoryPreserve = "yes";
ReadWritePaths = [ cfg.cdnPath ];
NoExecPaths = [ cfg.cdnPath ];
Restart = "on-failure";
RestartSec = 10;
StartLimitBurst = 5;
UMask = "077";
}
// lib.optionalAttrs (cfg.databaseFile != null) { EnvironmentFile = cfg.databaseFile; };
} conf)
{
}
|
