From db64f7f7379858bfa3172a4fce108ef8a25df96d Mon Sep 17 00:00:00 2001
From: Matt McHenry <github@matt.mchenryfamily.org>
Date: Tue, 12 Dec 2023 21:34:58 -0500
Subject: [PATCH] lorri.service: remove ProtectHome, relax ProtectSystem

per lorri's readme:

  lorri creates an indirect garbage collection root for each .drv in
  $XDG_CACHE_HOME/lorri (~/.cache/lorri/ by default) each time it
  evaluates your project.

... so it doesn't make sense to have ProtectHome enabled for
lorri.service.  lorri also needs to be able to modify
/nix/var/nix/gcroots/per-user/, so ProtectSystem can't be 'strict';
'full' is the next strongest.

fixes:

lorri: ERRO IO error binding to socket: Read-only file system (os error 30)

bisecting this error leads to a range of unbuildable commits including
'a31429165204 Merge pull request #243242 from
RaitoBezarius/systemd-254', so it's likely that systemd update changed
the behaviour of ProtectHome somehow (though the release notes don't
have any obvious culprits).
---
 nixos/modules/services/development/lorri.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/nixos/modules/services/development/lorri.nix b/nixos/modules/services/development/lorri.nix
index 74f56f5890fc..df3d814d7444 100644
--- a/nixos/modules/services/development/lorri.nix
+++ b/nixos/modules/services/development/lorri.nix
@@ -44,8 +44,7 @@ in {
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/lorri daemon";
         PrivateTmp = true;
-        ProtectSystem = "strict";
-        ProtectHome = "read-only";
+        ProtectSystem = "full";
         Restart = "on-failure";
       };
     };