24.11

base/services/auto-upgrade.nix

@@ -2,12 +2,12 @@
 {
   system.autoUpgrade = {
     enable = true;
-    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
+    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git?ref=24.11";
     flags = [
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
       # https://git.lix.systems/lix-project/lix/issues/400
       "--refresh"
-      "--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.05-small"
+      "--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.11-small"
       "--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
       "--no-write-lock-file"
     ];

base/services/logrotate.nix

@@ -31,7 +31,6 @@
       ProtectSystem = "full";
       RestrictNamespaces = true;
       RestrictRealtime = true;
-      RestrictSUIDSGID = true; # disable for creating setgid directories
       SocketBindDeny = [ "any" ];
       SystemCallArchitectures = "native";
       SystemCallFilter = [
@@ -39,4 +38,4 @@
       ];
     };
   };
-}
+}

base/services/nginx.nix

@@ -33,6 +33,10 @@
 
   systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
     LimitNOFILE = 65536;
+    # We use jit my dudes
+    MemoryDenyWriteExecute = lib.mkForce false;
+    # What the fuck do we use that where the defaults are not enough???
+    SystemCallFilter = lib.mkForce null;
   };
 
   services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
@@ -41,4 +45,4 @@
     addSSL = true;
     extraConfig = "return 444;";
   };
-}
+}