44 lines
1.6 KiB
Nix
44 lines
1.6 KiB
Nix
# Public Matrix admin UI: a separate unprivileged, sandboxed identity.
|
|
# The root-owned binary and non-secret config remain read-only outside Nix.
|
|
# StateDirectory is deliberately DIFFERENT from the executable directory:
|
|
# systemd must never make the binary/config writable by the service user.
|
|
{ ... }:
|
|
{
|
|
systemd.services.tuwunel-admin = {
|
|
description = "tuwunel-admin (Matrix admin web UI)";
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
DynamicUser = true;
|
|
User = "tuwunel-admin";
|
|
StateDirectory = "tuwunel-admin-state";
|
|
StateDirectoryMode = "0700";
|
|
WorkingDirectory = "/var/lib/tuwunel-admin-state";
|
|
Environment = [ "HOME=/var/lib/tuwunel-admin-state" ];
|
|
ExecStart = "/var/lib/tuwunel-admin/tuwunel-admin --config /var/lib/tuwunel-admin/config.toml";
|
|
Restart = "on-failure";
|
|
RestartSec = 5;
|
|
UMask = "0077";
|
|
NoNewPrivileges = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
PrivateTmp = true;
|
|
PrivateDevices = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectControlGroups = true;
|
|
ProtectClock = true;
|
|
RestrictSUIDSGID = true;
|
|
RestrictNamespaces = true;
|
|
LockPersonality = true;
|
|
CapabilityBoundingSet = "";
|
|
AmbientCapabilities = "";
|
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
|
MemoryMax = "256M";
|
|
TasksMax = 128;
|
|
};
|
|
};
|
|
}
|