ag/strojnadzor
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Harden the systemd service

Browse source
This commit is contained in:
Andrey Golovizin 2020-03-10 22:51:21 +01:00
parent 4d687b0d40
commit 43f9ae1311
1 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
module.nix
View file

@ -90,6 +90,17 @@ in
ExecStartPre = "${strojnadzor}/bin/strojnadzor-admin migrate"; ExecStartPre = "${strojnadzor}/bin/strojnadzor-admin migrate";
ExecStart = "${strojnadzor}/bin/strojnadzor-admin runserver-gunicorn"; ExecStart = "${strojnadzor}/bin/strojnadzor-admin runserver-gunicorn";
StateDirectory = "strojnadzor"; StateDirectory = "strojnadzor";
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
RestrictNamespaces = true;
PrivateTmp = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
RestrictSUIDSGID = true;
}; };
environment.STROJNADZOR_DATA_DIR = "${cfg.stateDir}"; environment.STROJNADZOR_DATA_DIR = "${cfg.stateDir}";
}; };