gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/servarr: Harden systemd services for sonarr and radarr (#483483)

Browse Source
This commit is contained in:
isabel
2026-02-17 21:26:01 +00:00
committed by GitHub
parent d73ce0f5ef e23c69f953
commit 21c8264c5f
2 changed files with 68 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/misc/servarr/radarr.nix
+34
View File
@@ -64,6 +64,40 @@ in
EnvironmentFile = cfg.environmentFiles;
ExecStart = "${cfg.package}/bin/Radarr -nobrowser -data='${cfg.dataDir}'";
Restart = "on-failure";
# Hardening
CapabilityBoundingSet = "";
NoNewPrivileges = true;
ProtectHome = true;
ProtectClock = true;
ProtectKernelLogs = true;
PrivateTmp = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
UMask = "0022";
ProtectHostname = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
LockPersonality = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@debug"
"~@mount"
"@chown"
];
};
};
nixos/modules/services/misc/servarr/sonarr.nix
+34
View File
@@ -86,6 +86,40 @@ in
"-data=${cfg.dataDir}"
];
Restart = "on-failure";
# Hardening
CapabilityBoundingSet = "";
NoNewPrivileges = true;
ProtectHome = true;
ProtectClock = true;
ProtectKernelLogs = true;
PrivateTmp = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
UMask = "0022";
ProtectHostname = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
LockPersonality = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@debug"
"~@mount"
"@chown"
];
}
// lib.optionalAttrs (cfg.dataDir == "/var/lib/sonarr/.config/NzbDrone") {
StateDirectory = "sonarr";