From 5d67f1fa0e7dfbfb0a6937138ccbf99c163f75a8 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Thu, 8 Jan 2026 01:15:56 +0000
Subject: [PATCH] nixos/flaresolverr: add systemd hardening

Capabilities and system call filtering have been obtained using SHH [1],
while the remaining options were enabled until the service started
breaking.

[1]: https://github.com/desbma/shh
---
 nixos/modules/services/misc/flaresolverr.nix | 62 ++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/nixos/modules/services/misc/flaresolverr.nix b/nixos/modules/services/misc/flaresolverr.nix
index 7967580307f9..16313d7de3c6 100644
--- a/nixos/modules/services/misc/flaresolverr.nix
+++ b/nixos/modules/services/misc/flaresolverr.nix
@@ -46,10 +46,72 @@ in
         RestartSec = 5;
         Type = "simple";
         DynamicUser = true;
+        UMask = "0077";
         RuntimeDirectory = "flaresolverr";
         WorkingDirectory = "/run/flaresolverr";
         ExecStart = lib.getExe cfg.package;
         TimeoutStopSec = 30;
+
+        # Systemd hardening
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictRealtime = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = [
+          "net"
+          "pid"
+          "user"
+        ];
+        CapabilityBoundingSet = [
+          "~CAP_BLOCK_SUSPEND"
+          "~CAP_BPF"
+          "~CAP_CHOWN"
+          "~CAP_IPC_LOCK"
+          "~CAP_MKNOD"
+          "~CAP_NET_ADMIN"
+          "~CAP_NET_RAW"
+          "~CAP_PERFMON"
+          "~CAP_SYSLOG"
+          "~CAP_SYS_ADMIN"
+          "~CAP_SYS_BOOT"
+          "~CAP_SYS_MODULE"
+          "~CAP_SYS_PACCT"
+          "~CAP_SYS_PTRACE"
+          "~CAP_SYS_TIME"
+          "~CAP_WAKE_ALARM"
+        ];
+        SystemCallFilter = [
+          "~@chown"
+          "~@clock"
+          "~@cpu-emulation"
+          "~@debug"
+          "~@keyring"
+          "~@memlock"
+          "~@module"
+          "~@obsolete"
+          "~@pkey"
+          "~@raw-io"
+          "~@reboot"
+          "~@setuid"
+          "~@swap"
+          "~@timer"
+        ];
+        SystemCallErrorNumber = "EPERM";
+        SystemCallArchitectures = "native";
       };
     };