From 9c9b748d4fc6183b88f14eb4efc6ca6c974ed5c3 Mon Sep 17 00:00:00 2001 From: zeus Date: Thu, 27 Nov 2025 23:58:38 +0800 Subject: [PATCH 1/3] nixos/frp: guard server-only systemd options --- nixos/modules/services/networking/frp.nix | 66 ++++++++++++----------- 1 file changed, 35 insertions(+), 31 deletions(-) diff --git a/nixos/modules/services/networking/frp.nix b/nixos/modules/services/networking/frp.nix index da731dabf082..240345c6ca13 100644 --- a/nixos/modules/services/networking/frp.nix +++ b/nixos/modules/services/networking/frp.nix @@ -59,37 +59,41 @@ in after = if isClient then [ "network-online.target" ] else [ "network.target" ]; wantedBy = [ "multi-user.target" ]; description = "A fast reverse proxy frp ${cfg.role}"; - serviceConfig = { - Type = "simple"; - Restart = "on-failure"; - RestartSec = 15; - ExecStart = "${cfg.package}/bin/${executableFile} --strict_config -c ${configFile}"; - StateDirectoryMode = lib.optionalString isServer "0700"; - DynamicUser = true; - # Hardening - UMask = lib.optionalString isServer "0007"; - CapabilityBoundingSet = serviceCapability; - AmbientCapabilities = serviceCapability; - PrivateDevices = true; - ProtectHostname = true; - ProtectClock = true; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectKernelLogs = true; - ProtectControlGroups = true; - RestrictAddressFamilies = [ - "AF_INET" - "AF_INET6" - ] - ++ lib.optionals isClient [ "AF_UNIX" ]; - LockPersonality = true; - MemoryDenyWriteExecute = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - PrivateMounts = true; - SystemCallArchitectures = "native"; - SystemCallFilter = [ "@system-service" ]; - }; + serviceConfig = + { + Type = "simple"; + Restart = "on-failure"; + RestartSec = 15; + ExecStart = "${cfg.package}/bin/${executableFile} --strict_config -c ${configFile}"; + DynamicUser = true; + # Hardening + CapabilityBoundingSet = serviceCapability; + AmbientCapabilities = serviceCapability; + PrivateDevices = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + ] + ++ lib.optionals isClient [ "AF_UNIX" ]; + LockPersonality = true; + MemoryDenyWriteExecute = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + PrivateMounts = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ "@system-service" ]; + } + // lib.optionalAttrs isServer { + StateDirectory = "frp"; + StateDirectoryMode = "0700"; + UMask = "0007"; + }; }; }; }; From 79e17b64a8138a33baaf579e1302b4fff7c05f3f Mon Sep 17 00:00:00 2001 From: zeus Date: Fri, 28 Nov 2025 00:25:40 +0800 Subject: [PATCH 2/3] nixos/frp: format --- nixos/modules/services/networking/frp.nix | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/networking/frp.nix b/nixos/modules/services/networking/frp.nix index 240345c6ca13..6dad539a201a 100644 --- a/nixos/modules/services/networking/frp.nix +++ b/nixos/modules/services/networking/frp.nix @@ -1,8 +1,7 @@ -{ - config, - lib, - pkgs, - ... +{ config +, lib +, pkgs +, ... }: let cfg = config.services.frp; From 0ced15beb8f6efc6dcc13d047fc4a705eb600a5a Mon Sep 17 00:00:00 2001 From: zeus Date: Fri, 28 Nov 2025 00:32:22 +0800 Subject: [PATCH 3/3] nixos/frp: satisfy treefmt --- nixos/modules/services/networking/frp.nix | 78 +++++++++++------------ 1 file changed, 39 insertions(+), 39 deletions(-) diff --git a/nixos/modules/services/networking/frp.nix b/nixos/modules/services/networking/frp.nix index 6dad539a201a..f59074688b6c 100644 --- a/nixos/modules/services/networking/frp.nix +++ b/nixos/modules/services/networking/frp.nix @@ -1,7 +1,8 @@ -{ config -, lib -, pkgs -, ... +{ + config, + lib, + pkgs, + ... }: let cfg = config.services.frp; @@ -58,41 +59,40 @@ in after = if isClient then [ "network-online.target" ] else [ "network.target" ]; wantedBy = [ "multi-user.target" ]; description = "A fast reverse proxy frp ${cfg.role}"; - serviceConfig = - { - Type = "simple"; - Restart = "on-failure"; - RestartSec = 15; - ExecStart = "${cfg.package}/bin/${executableFile} --strict_config -c ${configFile}"; - DynamicUser = true; - # Hardening - CapabilityBoundingSet = serviceCapability; - AmbientCapabilities = serviceCapability; - PrivateDevices = true; - ProtectHostname = true; - ProtectClock = true; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectKernelLogs = true; - ProtectControlGroups = true; - RestrictAddressFamilies = [ - "AF_INET" - "AF_INET6" - ] - ++ lib.optionals isClient [ "AF_UNIX" ]; - LockPersonality = true; - MemoryDenyWriteExecute = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - PrivateMounts = true; - SystemCallArchitectures = "native"; - SystemCallFilter = [ "@system-service" ]; - } - // lib.optionalAttrs isServer { - StateDirectory = "frp"; - StateDirectoryMode = "0700"; - UMask = "0007"; - }; + serviceConfig = { + Type = "simple"; + Restart = "on-failure"; + RestartSec = 15; + ExecStart = "${cfg.package}/bin/${executableFile} --strict_config -c ${configFile}"; + DynamicUser = true; + # Hardening + CapabilityBoundingSet = serviceCapability; + AmbientCapabilities = serviceCapability; + PrivateDevices = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + ] + ++ lib.optionals isClient [ "AF_UNIX" ]; + LockPersonality = true; + MemoryDenyWriteExecute = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + PrivateMounts = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ "@system-service" ]; + } + // lib.optionalAttrs isServer { + StateDirectory = "frp"; + StateDirectoryMode = "0700"; + UMask = "0007"; + }; }; }; };