From 5d67f1fa0e7dfbfb0a6937138ccbf99c163f75a8 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Thu, 8 Jan 2026 01:15:56 +0000
Subject: [PATCH 1/2] nixos/flaresolverr: add systemd hardening

Capabilities and system call filtering have been obtained using SHH [1],
while the remaining options were enabled until the service started
breaking.

[1]: https://github.com/desbma/shh
---
 nixos/modules/services/misc/flaresolverr.nix | 62 ++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/nixos/modules/services/misc/flaresolverr.nix b/nixos/modules/services/misc/flaresolverr.nix
index 7967580307f9..16313d7de3c6 100644
--- a/nixos/modules/services/misc/flaresolverr.nix
+++ b/nixos/modules/services/misc/flaresolverr.nix
@@ -46,10 +46,72 @@ in
         RestartSec = 5;
         Type = "simple";
         DynamicUser = true;
+        UMask = "0077";
         RuntimeDirectory = "flaresolverr";
         WorkingDirectory = "/run/flaresolverr";
         ExecStart = lib.getExe cfg.package;
         TimeoutStopSec = 30;
+
+        # Systemd hardening
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictRealtime = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = [
+          "net"
+          "pid"
+          "user"
+        ];
+        CapabilityBoundingSet = [
+          "~CAP_BLOCK_SUSPEND"
+          "~CAP_BPF"
+          "~CAP_CHOWN"
+          "~CAP_IPC_LOCK"
+          "~CAP_MKNOD"
+          "~CAP_NET_ADMIN"
+          "~CAP_NET_RAW"
+          "~CAP_PERFMON"
+          "~CAP_SYSLOG"
+          "~CAP_SYS_ADMIN"
+          "~CAP_SYS_BOOT"
+          "~CAP_SYS_MODULE"
+          "~CAP_SYS_PACCT"
+          "~CAP_SYS_PTRACE"
+          "~CAP_SYS_TIME"
+          "~CAP_WAKE_ALARM"
+        ];
+        SystemCallFilter = [
+          "~@chown"
+          "~@clock"
+          "~@cpu-emulation"
+          "~@debug"
+          "~@keyring"
+          "~@memlock"
+          "~@module"
+          "~@obsolete"
+          "~@pkey"
+          "~@raw-io"
+          "~@reboot"
+          "~@setuid"
+          "~@swap"
+          "~@timer"
+        ];
+        SystemCallErrorNumber = "EPERM";
+        SystemCallArchitectures = "native";
       };
     };
 

From 92eded4aeeb1d83764a05314ec58d9440c7663f2 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Thu, 8 Jan 2026 01:20:09 +0000
Subject: [PATCH 2/2] {,nixos/,tests/}flaresolverr: add diogotcorreia as
 maintainer

---
 nixos/modules/services/misc/flaresolverr.nix | 2 ++
 nixos/tests/flaresolverr.nix                 | 2 +-
 pkgs/by-name/fl/flaresolverr/package.nix     | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/misc/flaresolverr.nix b/nixos/modules/services/misc/flaresolverr.nix
index 16313d7de3c6..8aad08abd781 100644
--- a/nixos/modules/services/misc/flaresolverr.nix
+++ b/nixos/modules/services/misc/flaresolverr.nix
@@ -117,4 +117,6 @@ in
 
     networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.port ]; };
   };
+
+  meta.maintainers = with lib.maintainers; [ diogotcorreia ];
 }
diff --git a/nixos/tests/flaresolverr.nix b/nixos/tests/flaresolverr.nix
index db25ab117cad..19b95565bcb8 100644
--- a/nixos/tests/flaresolverr.nix
+++ b/nixos/tests/flaresolverr.nix
@@ -1,7 +1,7 @@
 { lib, ... }:
 {
   name = "flaresolverr";
-  meta.maintainers = [ ];
+  meta.maintainers = with lib.maintainers; [ diogotcorreia ];
 
   nodes.machine =
     { pkgs, ... }:
diff --git a/pkgs/by-name/fl/flaresolverr/package.nix b/pkgs/by-name/fl/flaresolverr/package.nix
index 8375fe0d3601..5866da41fdfd 100644
--- a/pkgs/by-name/fl/flaresolverr/package.nix
+++ b/pkgs/by-name/fl/flaresolverr/package.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/FlareSolverr/FlareSolverr/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     mainProgram = "flaresolverr";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ diogotcorreia ];
     inherit (undetected-chromedriver.meta) platforms;
   };
 })