From af671ded863a26a789a83e08c80be4d4a1b04ac2 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Mon, 6 Oct 2025 14:17:28 +0200
Subject: [PATCH 1/3] nixos/murmur: Enable MountAPIVFS hardening in service
 config

This setting is already implied by others, but add it for completeness
as well. For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#MountAPIVFS=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/networking/murmur.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index 87c309e6a2e9..ba6e5f5fe52d 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -345,6 +345,7 @@ in
         CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
+        MountAPIVFS = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;

From 9bd10e556b222e1b84094d3ad17649a041736b94 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Mon, 6 Oct 2025 14:17:43 +0200
Subject: [PATCH 2/3] nixos/murmur: Enable PrivateUsers hardening in service
 config

For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#PrivateUsers=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/networking/murmur.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index ba6e5f5fe52d..ef2bd0b28b6d 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -350,6 +350,7 @@ in
         PrivateDevices = true;
         PrivateMounts = true;
         PrivateTmp = true;
+        PrivateUsers = true;
         ProtectClock = true;
         ProtectControlGroups = "strict";
         ProtectHome = true;

From 9638a1ba2483c956da0b53ae406e188941e65946 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Mon, 6 Oct 2025 14:24:41 +0200
Subject: [PATCH 3/3] nixos/murmur: Set ProtectProc to `invisible`

For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectProc=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/networking/murmur.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index ef2bd0b28b6d..c67b4ac47390 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -358,6 +358,7 @@ in
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
+        ProtectProc = "invisible";
         ProtectSystem = "strict";
         ReadWritePaths = [
           cfg.stateDir