diff options
author | Will Dietz <w@wdtz.org> | 2019-05-03 01:46:41 -0500 |
---|---|---|
committer | Will Dietz <w@wdtz.org> | 2019-05-03 01:47:57 -0500 |
commit | 329df959581629113d4643465d1a2fcddef7fef2 (patch) | |
tree | 7aca64b57509ac49d1d0bb252b17aa4947ed5ad2 /nixos/modules/services/monitoring/vnstat.nix | |
parent | f58482658eabf7d695f45904ecbc5f49c19fef98 (diff) | |
download | nixpkgs-329df959581629113d4643465d1a2fcddef7fef2.tar nixpkgs-329df959581629113d4643465d1a2fcddef7fef2.tar.gz nixpkgs-329df959581629113d4643465d1a2fcddef7fef2.tar.bz2 nixpkgs-329df959581629113d4643465d1a2fcddef7fef2.tar.lz nixpkgs-329df959581629113d4643465d1a2fcddef7fef2.tar.xz nixpkgs-329df959581629113d4643465d1a2fcddef7fef2.tar.zst nixpkgs-329df959581629113d4643465d1a2fcddef7fef2.zip |
vnstat: 2.1 -> 2.2
https://humdi.net/vnstat/CHANGES * enable tests * add hardening options from upstream's example service * fix "documentation" setting in service: either needs to be `unitConfig.Documentation` (uppercase) or lowercase but not within unitConfig.
Diffstat (limited to 'nixos/modules/services/monitoring/vnstat.nix')
-rw-r--r-- | nixos/modules/services/monitoring/vnstat.nix | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/nixos/modules/services/monitoring/vnstat.nix b/nixos/modules/services/monitoring/vnstat.nix index cb2f8c07edb..e9bedb704a4 100644 --- a/nixos/modules/services/monitoring/vnstat.nix +++ b/nixos/modules/services/monitoring/vnstat.nix @@ -28,14 +28,29 @@ in { path = [ pkgs.coreutils ]; after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; - unitConfig.documentation = "man:vnstatd(1) man:vnstat(1) man:vnstat.conf(5)"; + documentation = [ + "man:vnstatd(1)" + "man:vnstat(1)" + "man:vnstat.conf(5)" + ]; preStart = "chmod 755 /var/lib/vnstat"; serviceConfig = { ExecStart = "${pkgs.vnstat}/bin/vnstatd -n"; ExecReload = "${pkgs.procps}/bin/kill -HUP $MAINPID"; - ProtectHome = true; + + # Hardening (from upstream example service) + ProtectSystem = "strict"; + StateDirectory = "vnstat"; PrivateDevices = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectKernelModules = true; PrivateTmp = true; + MemoryDenyWriteExecute = true; + RestrictRealtime = true; + RestrictNamespaces = true; + User = "vnstatd"; }; }; |