nixos/tor: add onion service unix sockets to BindPaths (#440889)

2025-10-13 14:22:31 +00:00
parent 1f47d9701e 16a1b0e531
commit e0e68c546b
1 changed files with 8 additions and 1 deletions
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@@ -1410,7 +1410,14 @@ in
        RootDirectoryStartOnly = true;
        #InaccessiblePaths = [ "-+${runDir}/root" ];
        UMask = "0066";
-        BindPaths = [ stateDir ];
+        BindPaths = [
+          stateDir
+        ]
+        ++ lib.catAttrs "unix" (
+          lib.catAttrs "target" (
+            lib.concatMap (onionService: onionService.map) (lib.attrValues cfg.relay.onionServices)
+          )
+        );
        BindReadOnlyPaths = [
          builtins.storeDir
          "/etc"