From 25181b596fb23a8d2cda1dac2ebe2d5943c80cef Mon Sep 17 00:00:00 2001
From: rht <rhtbot@protonmail.com>
Date: Sun, 21 Jan 2024 20:53:29 -0500
Subject: [PATCH 1/2] thinkfan: Disable network access

---
 nixos/modules/services/hardware/thinkfan.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/hardware/thinkfan.nix b/nixos/modules/services/hardware/thinkfan.nix
index cca35f492b8e..b62fb5e9f8c9 100644
--- a/nixos/modules/services/hardware/thinkfan.nix
+++ b/nixos/modules/services/hardware/thinkfan.nix
@@ -217,8 +217,13 @@ in {
 
     systemd.services = {
       thinkfan.environment.THINKFAN_ARGS = escapeShellArgs ([ "-c" configFile ] ++ cfg.extraArgs);
-      thinkfan.serviceConfig.Restart = "on-failure";
-      thinkfan.serviceConfig.RestartSec = "30s";
+      thinkfan.serviceConfig = {
+        Restart = "on-failure";
+        RestartSec = "30s";
+
+        # Hardening
+        PrivateNetwork = true;
+      };
 
       # must be added manually, see issue #81138
       thinkfan.wantedBy = [ "multi-user.target" ];

From cee68718db905fb78144cba5bd07d4822881cbb3 Mon Sep 17 00:00:00 2001
From: rht <rhtbot@protonmail.com>
Date: Sun, 21 Jan 2024 21:08:34 -0500
Subject: [PATCH 2/2] hddfancontrol: Disable network access

---
 nixos/modules/services/hardware/hddfancontrol.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nixos/modules/services/hardware/hddfancontrol.nix b/nixos/modules/services/hardware/hddfancontrol.nix
index f472b5774cbf..746154e7aa17 100644
--- a/nixos/modules/services/hardware/hddfancontrol.nix
+++ b/nixos/modules/services/hardware/hddfancontrol.nix
@@ -60,6 +60,10 @@ in
       systemd.services.hddfancontrol = {
         wantedBy = [ "multi-user.target" ];
         environment.HDDFANCONTROL_ARGS = lib.escapeShellArgs args;
+        serviceConfig = {
+          # Hardening
+          PrivateNetwork = true;
+        };
       };
     }
   );