felixalb/pvv-nixos-config
1
0
Fork 0
mirror of https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git synced 2026-05-28 17:21:12 +02:00
Code Issues Projects Releases Wiki Activity

bicep/matrix-hookshot: harden

Browse Source
This commit is contained in:
h7x4
2026-05-28 15:39:47 +09:00
parent 8416014aeb
commit 788f23bf04
1 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
hosts/bicep/services/matrix/hookshot/default.nix
View File

@@ -22,6 +22,7 @@ in
sops.templates."hookshot-registration.yaml" = { sops.templates."hookshot-registration.yaml" = {
owner = config.users.users.matrix-synapse.name; owner = config.users.users.matrix-synapse.name;
group = config.users.groups.keys-matrix-registrations.name; group = config.users.groups.keys-matrix-registrations.name;
mode = "0440";
restartUnits = [ "matrix-hookshot.service" ]; restartUnits = [ "matrix-hookshot.service" ];
content = '' content = ''
id: matrix-hookshot id: matrix-hookshot
@@ -49,12 +50,59 @@ in
systemd.services.matrix-hookshot = { systemd.services.matrix-hookshot = {
serviceConfig = { serviceConfig = {
DynamicUser = true;
SupplementaryGroups = [ SupplementaryGroups = [
config.users.groups.keys-matrix-registrations.name config.users.groups.keys-matrix-registrations.name
]; ];
LoadCredential = [ LoadCredential = [
"passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}" "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
]; ];
RuntimeDirectory = [ "matrix-hookshot/root-mnt" ];
RootDirectory = "/run/matrix-hookshot/root-mnt";
BindReadOnlyPaths = [
config.sops.templates."hookshot-registration.yaml".path
builtins.storeDir
"/etc"
"/run/nscd"
"/var/run/nscd"
];
AmbientCapabilities = "";
CapabilityBoundingSet = "";
LockPersonality = true;
MemoryDenyWriteExecute = false; # node needs this
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
];
UMask = "0077";
}; };
}; };