From f394e3ecfd45521e0876ae39b726bb73ab2b04c6 Mon Sep 17 00:00:00 2001
From: Matt Moriarity <matt@mattmoriarity.com>
Date: Thu, 4 Jun 2026 19:07:10 -0600
Subject: [PATCH] nixos/ghostunnel: disable landlock

---
 nixos/modules/services/networking/ghostunnel.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/ghostunnel.nix b/nixos/modules/services/networking/ghostunnel.nix
index ea087d699e70..5bbbbd2ae2ff 100644
--- a/nixos/modules/services/networking/ghostunnel.nix
+++ b/nixos/modules/services/networking/ghostunnel.nix
@@ -196,7 +196,12 @@ let
               ++ optional (config.cacert != null) "cacert:${config.cacert}";
           };
           script = concatStringsSep " " (
-            [ "${mainCfg.package}/bin/ghostunnel" ]
+            [
+              "${mainCfg.package}/bin/ghostunnel"
+              # ghostunnel's landlock rules don't like reading the CA certs from /etc
+              # because they are links to /nix/store, which isn't part of its rules
+              "--disable-landlock"
+            ]
             ++ optional (config.keystore != null) "--keystore=$CREDENTIALS_DIRECTORY/keystore"
             ++ optional (config.cert != null) "--cert=$CREDENTIALS_DIRECTORY/cert"
             ++ optional (config.key != null) "--key=$CREDENTIALS_DIRECTORY/key"