From dea0cb06e3e0bd890d814f9f9b0d9581e93a6a10 Mon Sep 17 00:00:00 2001
From: Alex Martens <alex@thinglab.org>
Date: Wed, 29 Jan 2025 19:41:56 -0800
Subject: [PATCH] nixos/open-webui: add additional systemd hardening

---
 nixos/modules/services/misc/open-webui.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/nixos/modules/services/misc/open-webui.nix b/nixos/modules/services/misc/open-webui.nix
index 37cf05fe012b..83ee7779bb33 100644
--- a/nixos/modules/services/misc/open-webui.nix
+++ b/nixos/modules/services/misc/open-webui.nix
@@ -120,6 +120,18 @@ in
         RestrictRealtime = true;
         SystemCallArchitectures = "native";
         UMask = "0077";
+        CapabilityBoundingSet = "";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        ProtectClock = true;
+        ProtectProc = "invisible";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
       };
     };