nixos/immichframe: add more systemd hardening

Based on Jellyfin but a little stricter because it doesn't do as much.
2026-07-10 01:52:48 -07:00
parent 492ef5cbeb
commit 2a28ddd27e
1 changed files with 34 additions and 0 deletions
@@ -134,6 +134,40 @@ in
          Type = "simple";
          Restart = "on-failure";
          RestartSec = 3;
+
+          # systemd hardening, based on jellyfin (also .NET) but stricter
+          CapabilityBoundingSet = [ "" ];
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = !config.boot.isContainer;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = !config.boot.isContainer;
+          ProtectKernelTunables = !config.boot.isContainer;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          # no AF_NETLINK here since there's no network connection monitoring
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = !config.boot.isContainer;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallErrorNumber = "EPERM";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          UMask = "0077";
        };
      };
  };