nixos/frp: guard server-only systemd options (#465661)

2025-11-30 10:26:35 +00:00
parent e9c690b2db 0ced15beb8
commit a6f8ebd49f
1 changed files with 5 additions and 2 deletions
@@ -64,10 +64,8 @@ in
            Restart = "on-failure";
            RestartSec = 15;
            ExecStart = "${cfg.package}/bin/${executableFile} --strict_config -c ${configFile}";
-            StateDirectoryMode = lib.optionalString isServer "0700";
            DynamicUser = true;
            # Hardening
-            UMask = lib.optionalString isServer "0007";
            CapabilityBoundingSet = serviceCapability;
            AmbientCapabilities = serviceCapability;
            PrivateDevices = true;
@@ -89,6 +87,11 @@ in
            PrivateMounts = true;
            SystemCallArchitectures = "native";
            SystemCallFilter = [ "@system-service" ];
+          }
+          // lib.optionalAttrs isServer {
+            StateDirectory = "frp";
+            StateDirectoryMode = "0700";
+            UMask = "0007";
          };
        };
      };