From fbc4fb40bb3170da6e15b83f5f69445b91dbec13 Mon Sep 17 00:00:00 2001
From: Anna Aurora <anna@annaaurora.eu>
Date: Sun, 26 Jan 2025 21:53:02 +0100
Subject: [PATCH 1/3] =?UTF-8?q?meme-bingo-web:=201.1.0=20=E2=86=92=201.2.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/me/meme-bingo-web/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/me/meme-bingo-web/package.nix b/pkgs/by-name/me/meme-bingo-web/package.nix
index 8652e82b041d..dfd90634164c 100644
--- a/pkgs/by-name/me/meme-bingo-web/package.nix
+++ b/pkgs/by-name/me/meme-bingo-web/package.nix
@@ -8,14 +8,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "meme-bingo-web";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "annaaurora";
     repo = "meme-bingo-web";
     rev = "v${version}";
-    hash = "sha256-AKY0EjeoOnliRN3XSnlCgzCvnWOkZPQz/9QIcr8+hQM=";
+    hash = "sha256-0ahyyuihpwmAmaBwZv7lNmjuy8UsAm1a9XUhWcYq76w=";
   };
 
   useFetchCargoVendor = true;

From db6c59929b8dd89e563316bd699ebc364a7120be Mon Sep 17 00:00:00 2001
From: Anna Aurora <anna@annaaurora.eu>
Date: Sun, 23 Feb 2025 17:47:29 +0100
Subject: [PATCH 2/3] nixos/meme-bingo-web: add address and openFirewall
 options

---
 nixos/modules/services/web-apps/meme-bingo-web.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/nixos/modules/services/web-apps/meme-bingo-web.nix b/nixos/modules/services/web-apps/meme-bingo-web.nix
index 68be85906075..7573e325e860 100644
--- a/nixos/modules/services/web-apps/meme-bingo-web.nix
+++ b/nixos/modules/services/web-apps/meme-bingo-web.nix
@@ -36,6 +36,14 @@ in
         default = "http://localhost:41678/";
         example = "https://bingo.example.com/";
       };
+      address = mkOption {
+        description = ''
+          The address the webserver will bind to.
+        '';
+        type = types.str;
+        default = "localhost";
+        example = "::";
+      };
       port = mkOption {
         description = ''
           Port to be used for the web server.
@@ -44,16 +52,22 @@ in
         default = 41678;
         example = 21035;
       };
+      openFirewall = mkEnableOption ''
+        Opens the specified port in the firewall.
+      '';
     };
   };
 
   config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+
     systemd.services.meme-bingo-web = {
       description = "A web app for playing meme bingos";
       wantedBy = [ "multi-user.target" ];
 
       environment = {
         MEME_BINGO_BASE = cfg.baseUrl;
+        MEME_BINGO_ADDRESS = cfg.address;
         MEME_BINGO_PORT = toString cfg.port;
       };
       path = [ cfg.package ];

From 4d2bb49e75e0f6bbf5de394b3665bea3c9d7bdb4 Mon Sep 17 00:00:00 2001
From: Anna Aurora <anna@annaaurora.eu>
Date: Sun, 23 Feb 2025 17:47:56 +0100
Subject: [PATCH 3/3] nixos/meme-bingo-web: harden

---
 nixos/modules/services/web-apps/meme-bingo-web.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/services/web-apps/meme-bingo-web.nix b/nixos/modules/services/web-apps/meme-bingo-web.nix
index 7573e325e860..5bda9afcf88d 100644
--- a/nixos/modules/services/web-apps/meme-bingo-web.nix
+++ b/nixos/modules/services/web-apps/meme-bingo-web.nix
@@ -89,6 +89,9 @@ in
         InaccessiblePaths = [
           "/dev/shm"
           "/sys"
+          "/run/dbus"
+          "/run/user"
+          "/run/nscd"
         ];
         LockPersonality = true;
         PrivateDevices = true;
@@ -124,6 +127,8 @@ in
         RemoveIPC = true;
         NoNewPrivileges = true;
         MemoryDenyWriteExecute = true;
+        ExecPaths = [ "/nix/store" ];
+        NoExecPaths = [ "/" ];
       };
     };
   };