From d9bf91700e617512efc2f62202117f442f1ad3c4 Mon Sep 17 00:00:00 2001
From: Malte Voos <git@mal.tc>
Date: Tue, 19 Nov 2024 01:40:59 +0100
Subject: [PATCH] nixos/acme: make address families in systemd service less
 restrictive

This change is to support LEGO's capability to spawn an external process that
solves the DNS-01 challenge. In particular, this enables a setup where LEGO
runs a shell script that uses nsd-control to add an appropriate zone to a
local NSD instance.
---
 nixos/modules/security/acme/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix
index 140fa590efef..4601a6e908dd 100644
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -87,6 +87,8 @@ let
     RestrictAddressFamilies = [
       "AF_INET"
       "AF_INET6"
+      "AF_UNIX"
+      "AF_NETLINK"
     ];
     RestrictNamespaces = true;
     RestrictRealtime = true;