From de90a8e827617e768c0d78e4c7507be59ced8bff Mon Sep 17 00:00:00 2001
From: Alf Helge Jakobsen <alfhj@stud.ntnu.no>
Date: Sat, 9 Nov 2024 21:58:38 +0100
Subject: [PATCH] Disable network because tar file is pushed from Microbel
 separately

---
 hosts/bekkalokk/services/website/fetch-gallery.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hosts/bekkalokk/services/website/fetch-gallery.nix b/hosts/bekkalokk/services/website/fetch-gallery.nix
index bd13460..a96d70e 100644
--- a/hosts/bekkalokk/services/website/fetch-gallery.nix
+++ b/hosts/bekkalokk/services/website/fetch-gallery.nix
@@ -70,7 +70,7 @@ in {
       MemoryDenyWriteExecute = true;
       NoNewPrivileges = true; # disable for third party rotate scripts
       PrivateDevices = true;
-      #PrivateNetwork = true; # disable for mail delivery
+      PrivateNetwork = true; # disable for mail delivery
       PrivateTmp = true;
       ProtectClock = true;
       ProtectControlGroups = true;
@@ -84,7 +84,7 @@ in {
       RestrictNamespaces = true;
       RestrictRealtime = true;
       RestrictSUIDSGID = true; # disable for creating setgid directories
-      #SocketBindDeny = [ "any" ];
+      SocketBindDeny = [ "any" ];
       SystemCallArchitectures = "native";
       SystemCallFilter = [
         "@system-service"