From 302eaedd92b5d9c9818ccda54c64088073606738 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Sun, 5 Oct 2025 15:38:50 +0200
Subject: [PATCH 1/3] nixos/gerrit: Enable MountAPIVFS hardening in service
 config

This setting is already implied by others, but add it for completeness
as well. For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#MountAPIVFS=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/web-apps/gerrit.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-apps/gerrit.nix b/nixos/modules/services/web-apps/gerrit.nix
index c1af294c7cd8..fd810d07883f 100644
--- a/nixos/modules/services/web-apps/gerrit.nix
+++ b/nixos/modules/services/web-apps/gerrit.nix
@@ -232,6 +232,7 @@ in
         AmbientCapabilities = "";
         CapabilityBoundingSet = "";
         LockPersonality = true;
+        MountAPIVFS = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;

From 1ed557f179a1b25cac81cbb70e1b81a7d60bc1fd Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Sun, 5 Oct 2025 15:58:16 +0200
Subject: [PATCH 2/3] nixos/gerrit: Set ProtectProc to `invisible`

For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectProc=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/web-apps/gerrit.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/gerrit.nix b/nixos/modules/services/web-apps/gerrit.nix
index fd810d07883f..8a8e299def7a 100644
--- a/nixos/modules/services/web-apps/gerrit.nix
+++ b/nixos/modules/services/web-apps/gerrit.nix
@@ -244,7 +244,7 @@ in
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
-        ProtectProc = "noaccess";
+        ProtectProc = "invisible";
         ProtectSystem = "full";
         RestrictAddressFamilies = [
           "AF_UNIX"

From 8dac7deb3de1dd1b6c1abf94c02486ec7cbb435b Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Sun, 5 Oct 2025 16:06:19 +0200
Subject: [PATCH 3/3] nixos/gerrit: Enable PrivateUsers hardening in service
 config

For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#PrivateUsers=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/web-apps/gerrit.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-apps/gerrit.nix b/nixos/modules/services/web-apps/gerrit.nix
index 8a8e299def7a..92464bb49a75 100644
--- a/nixos/modules/services/web-apps/gerrit.nix
+++ b/nixos/modules/services/web-apps/gerrit.nix
@@ -237,6 +237,7 @@ in
         PrivateDevices = true;
         PrivateMounts = true;
         PrivateTmp = true;
+        PrivateUsers = true;
         ProtectClock = true;
         ProtectControlGroups = "strict";
         ProtectHome = true;