From 26d0023f711f4ff496c0422b10f7dd19005d56d6 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Sat, 4 Oct 2025 11:58:09 +0200
Subject: [PATCH] nixos/gerrit: Enable PrivateMounts hardening in service
 config

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/web-apps/gerrit.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-apps/gerrit.nix b/nixos/modules/services/web-apps/gerrit.nix
index 82bce5ae545d..6f1c443c0838 100644
--- a/nixos/modules/services/web-apps/gerrit.nix
+++ b/nixos/modules/services/web-apps/gerrit.nix
@@ -232,6 +232,7 @@ in
         LockPersonality = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
+        PrivateMounts = true;
         PrivateTmp = true;
         ProtectClock = true;
         ProtectControlGroups = true;