felixalb/nixos-config
felixalb
/
nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

voyager: fix nextcloud startup problems

This commit is contained in:
Felix Albrigtsen 2024-02-08 14:45:56 +01:00
parent d645a8af8a
commit 6ed59e1b15
1 changed files with 23 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
hosts/voyager/services/nextcloud.nix
View File

@ -59,26 +59,29 @@ in {
after = [ "postgresql.service" ]; after = [ "postgresql.service" ];
}; };
systemd.services."phpfpm-nextcloud".serviceConfig = { systemd.services."phpfpm-nextcloud" = {
WorkingDirectory = "/var/lib/nextcloud"; requires = [ "var-lib-nextcloud.mount" ];
NoNewPrivileges = true; serviceConfig = {
PrivateDevices = true; WorkingDirectory = "/var/lib/nextcloud";
PrivateMounts = true; NoNewPrivileges = true;
PrivateTmp = true; PrivateDevices = true;
ProtectClock = true; PrivateMounts = true;
ProtectHome = true; PrivateTmp = true;
ProtectHostname = true; ProtectClock = true;
ProtectKernelLogs = true; ProtectHome = true;
ProtectKernelModules = true; ProtectHostname = true;
ProtectKernelTunables = true; ProtectKernelLogs = true;
ProtectProc = "invisible"; ProtectKernelModules = true;
ReadWritePaths = [ "/var/lib/nextcloud" "/run/phpfpm" "/run/systemd" "/run/secrets" "/nix/store" ]; ProtectKernelTunables = true;
RemoveIPC = true; ProtectProc = "invisible";
RestrictSUIDSGID = true; ReadWritePaths = [ "/var/lib/nextcloud" "/run/phpfpm" "/run/systemd" "/run/secrets" "/nix/store" ];
UMask = "0007"; RemoveIPC = true;
SystemCallArchitectures = "native"; RestrictSUIDSGID = true;
SystemCallFilter = "@system-service"; UMask = "0007";
CapabilityBoundingSet = "~CAP_FSETID ~CAP_SETFCAP ~CAP_SETUID ~CAP_SETGID ~CAP_SETPCAP ~CAP_NET_ADMIN ~CAP_SYS_ADMIN ~CAP_SYS_PTRACE "; SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
CapabilityBoundingSet = "~CAP_FSETID ~CAP_SETFCAP ~CAP_SETUID ~CAP_SETGID ~CAP_SETPCAP ~CAP_NET_ADMIN ~CAP_SYS_ADMIN ~CAP_SYS_PTRACE ";
};
}; };
fileSystems."/var/lib/nextcloud" = { fileSystems."/var/lib/nextcloud" = {