diff options
| author | Maximilian Bosch <maximilian@mbosch.me> | 2023-06-30 11:44:04 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-06-30 11:44:04 +0200 |
| commit | c1ea4ec7a909ac1042f92759199d2b9b11ccfdcf (patch) | |
| tree | cd6241a1d01b8e56207952c9effee6f3de93341d /nixos | |
| parent | 8ed827d534454eca7a1ef5eca7efbe0c9e0b8c84 (diff) | |
| parent | a0311e51077f7f097278fb53c0388fee19a27ef5 (diff) | |
Merge pull request #208605 from Izorkin/update-gitea
nixos/gitea: update configuration
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/services/misc/gitea.nix | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix index 5c35cfa177a2e..72fad73bae509 100644 --- a/nixos/modules/services/misc/gitea.nix +++ b/nixos/modules/services/misc/gitea.nix @@ -587,7 +587,10 @@ in Restart = "always"; # Runtime directory and mode RuntimeDirectory = "gitea"; - RuntimeDirectoryMode = "0755"; + RuntimeDirectoryMode = "0750"; + # Proc filesystem + ProcSubset = "pid"; + ProtectProc = "invisible"; # Access write directories ReadWritePaths = [ cfg.customDir cfg.dump.backupDir cfg.repositoryRoot cfg.stateDir cfg.lfs.contentDir ]; UMask = "0027"; @@ -607,15 +610,17 @@ in ProtectKernelModules = true; ProtectKernelLogs = true; ProtectControlGroups = true; - RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ]; + RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; + RestrictNamespaces = true; LockPersonality = true; MemoryDenyWriteExecute = true; RestrictRealtime = true; RestrictSUIDSGID = true; + RemoveIPC = true; PrivateMounts = true; # System Call Filtering SystemCallArchitectures = "native"; - SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap"; + SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" "setrlimit" ]; }; environment = { |