added some security options

2025-06-10 12:32:37 +02:00 · 2025-06-10 12:32:37 +02:00 · 95ffbf6300
commit 95ffbf6300
parent 85bae9d67d
1 changed files with 24 additions and 0 deletions
--- a/flake.nix
+++ b/flake.nix
@ -79,6 +79,30 @@
          serviceConfig = {
            ExecStart = "${cfg.package}/bin/sTodo";
            Restart = "always";
+            User = "sTodo";
+            Group = "sTodo";
+            StateDirectory = "sTodo";
+            StateDirectoryMode = "0700";
+
+            AmbientCapabilities = "";
+            CapabilityBoundingSet = "";
+            DeviceAllow = "";
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            NoNewPrivileges = true;
+
+            PrivateDevices = true;
+            PrivateUsers = true;
+
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = "read-only";
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "noaccess";
+            ProtectSystem = "strict";
          };
          environment = {
            YESOD_PORT = "${toString cfg.port}";