From 34db15c1fd2f2ee0a204757ceb5eb67102b98501 Mon Sep 17 00:00:00 2001
From: Anna Aurora <anna@annaaurora.eu>
Date: Thu, 4 Jan 2024 16:41:46 +0100
Subject: [PATCH 1/2] =?UTF-8?q?meme-bingo-web:=200.2.0=20=E2=86=92=201.0.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/servers/web-apps/meme-bingo-web/default.nix | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/web-apps/meme-bingo-web/default.nix b/pkgs/servers/web-apps/meme-bingo-web/default.nix
index 6a0228899f08..77c6c5bdaee5 100644
--- a/pkgs/servers/web-apps/meme-bingo-web/default.nix
+++ b/pkgs/servers/web-apps/meme-bingo-web/default.nix
@@ -1,18 +1,23 @@
-{ lib, fetchFromGitea, rustPlatform, makeWrapper }:
+{ lib
+, fetchFromGitea
+, rustPlatform
+, makeWrapper
+, nix-update-script
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "meme-bingo-web";
-  version = "0.2.0";
+  version = "1.0.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "annaaurora";
     repo = "meme-bingo-web";
     rev = "v${version}";
-    hash = "sha256-6hQra+10TaaQGzwiYfL+WHmGc6f0Hn8Tybd0lA5t0qc=";
+    hash = "sha256-mOcN9WIXJYRK23tMX29mT5/eSRpqb++zlnJnMizzIfY=";
   };
 
-  cargoHash = "sha256-/hBymxNAzyfapUL5Whkg4NBLA7Fc8A1npXEa9MXTAz4=";
+  cargoHash = "sha256-JWVsmw8ha2TSkCXyLPf9Qe1eL2OHB5uu+bSfCaF0lV8=";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -25,6 +30,8 @@ rustPlatform.buildRustPackage rec {
       --set MEME_BINGO_STATIC $out/share/meme-bingo-web/static
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Play meme bingo using this neat web app";
     mainProgram = "meme-bingo-web";

From dfd120537d6b2ceb0e7afc3323bdb4bda71b1f06 Mon Sep 17 00:00:00 2001
From: Anna Aurora <anna@annaaurora.eu>
Date: Tue, 10 Oct 2023 18:46:52 +0200
Subject: [PATCH 2/2] nixos/meme-bingo-web: fixed documentation, service
 description and did further hardening

---
 nixos/modules/services/web-apps/meme-bingo-web.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/meme-bingo-web.nix b/nixos/modules/services/web-apps/meme-bingo-web.nix
index ab123ba8ef9c..4623bc22c26f 100644
--- a/nixos/modules/services/web-apps/meme-bingo-web.nix
+++ b/nixos/modules/services/web-apps/meme-bingo-web.nix
@@ -17,7 +17,7 @@ in {
 
       baseUrl = mkOption {
         description = ''
-          URL to be used for the HTML <base> element on all HTML routes.
+          URL to be used for the HTML \<base\> element on all HTML routes.
         '';
         type = types.str;
         default = "http://localhost:41678/";
@@ -36,7 +36,7 @@ in {
 
   config = mkIf cfg.enable {
     systemd.services.meme-bingo-web = {
-      description = "A web app for playing meme bingos.";
+      description = "A web app for playing meme bingos";
       wantedBy = [ "multi-user.target" ];
 
       environment = {
@@ -59,6 +59,7 @@ in {
         # Hardening
         CapabilityBoundingSet = [ "" ];
         DeviceAllow = [ "/dev/random" ];
+        InaccessiblePaths = [ "/dev/shm" "/sys" ];
         LockPersonality = true;
         PrivateDevices = true;
         PrivateUsers = true;
@@ -73,6 +74,7 @@ in {
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
         RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictFilesystems = [ "@basic-api" "~sysfs" ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
         SystemCallArchitectures = "native";