felixalb/pvv-nixos-config
1
0
Fork 0
mirror of https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git synced 2026-05-25 07:41:13 +02:00
Code Issues Projects Releases Wiki Activity

bekkalokk/vaultwarden: remove redundant hardening

Browse Source 
This has already been upstreamed
This commit is contained in:
h7x4
2026-05-22 17:51:01 +09:00
parent 475f6a8c9b
commit 3141b1f76b
1 changed files with 0 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
hosts/bekkalokk/services/vaultwarden.nix
View File

@@ -79,40 +79,6 @@ in {
}; };
}; };
systemd.services.vaultwarden = lib.mkIf cfg.enable {
serviceConfig = {
AmbientCapabilities = [ "" ];
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
NoNewPrivileges = true;
# MemoryDenyWriteExecute = true;
PrivateMounts = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RemoveIPC = true;
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
};
};
services.rsync-pull-targets = { services.rsync-pull-targets = {
enable = true; enable = true;
locations."/var/lib/vaultwarden" = { locations."/var/lib/vaultwarden" = {