From 787354f63c3cda0c0fe312305e710ff8336327eb Mon Sep 17 00:00:00 2001
From: Marie Ramlow <me@nycode.dev>
Date: Tue, 2 Jul 2024 20:08:05 +0200
Subject: [PATCH] nixos/renovate: allow AF_UNIX access

renovate can update nix dependencies, which results in nix trying to communicate with the nix-daemon over a unix socket.
---
 nixos/modules/services/misc/renovate.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/misc/renovate.nix b/nixos/modules/services/misc/renovate.nix
index 25a719c91cbd..9062b7424b68 100644
--- a/nixos/modules/services/misc/renovate.nix
+++ b/nixos/modules/services/misc/renovate.nix
@@ -128,6 +128,7 @@ in
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
+          "AF_UNIX"
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;