From 81e2494e1873ce56d63c8649e22458e430f6ee46 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Thu, 18 Dec 2025 16:12:22 +0100
Subject: [PATCH] nixos/jenkins: Set ProtectSystem to strict

Protect most files and directories from being read or written by setting
ProtectSystem to strict. Exclude the Jenkins state directory from that
protection.

https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectSystem=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 .../services/continuous-integration/jenkins/default.nix      | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix
index 12ba4e342985..d1639ea1c345 100644
--- a/nixos/modules/services/continuous-integration/jenkins/default.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/default.nix
@@ -275,7 +275,10 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
-        ProtectSystem = "full";
+        ProtectSystem = "strict";
+        ReadWritePaths = [
+          cfg.home
+        ];
         RemoveIPC = true;
         RestrictAddressFamilies = [
           "AF_UNIX"