Compare commits
2 Commits
bdf983f954
...
4ff9f663eb
Author | SHA1 | Date |
---|---|---|
Oystein Kristoffer Tveit | 4ff9f663eb | |
Oystein Kristoffer Tveit | c5f606f910 |
44
module.nix
44
module.nix
|
@ -14,6 +14,8 @@ in
|
|||
|
||||
enablePipewire = lib.mkEnableOption "pipewire" // { default = true; };
|
||||
|
||||
enableDebug = lib.mkEnableOption "debug logs";
|
||||
|
||||
# TODO: create some better descriptions
|
||||
settings = {
|
||||
host = lib.mkOption {
|
||||
|
@ -95,11 +97,53 @@ in
|
|||
description = "greg-ng, an mpv based media player";
|
||||
wantedBy = [ "graphical-session.target" ];
|
||||
partOf = [ "graphical-session.target" ];
|
||||
environment = {
|
||||
RUST_LOG = lib.mkIf cfg.enableDebug "greg_ng=trace,mpvipc=trace";
|
||||
};
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}";
|
||||
Restart = "always";
|
||||
RestartSec = 3;
|
||||
|
||||
IPAddressDeny =
|
||||
lib.optionals (lib.elem cfg.settings.host [ null "localhost" "127.0.0.1" ]) [ "any" ];
|
||||
|
||||
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
|
||||
|
||||
AmbientCapabilities = [ "" ];
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DeviceAllow = [ "" ];
|
||||
LockPersonality = true;
|
||||
# Might work, but wouldn't bet on it with embedded scripting lang in mpv
|
||||
MemoryDenyWriteExecute = false;
|
||||
NoNewPrivileges = true;
|
||||
# MPV and mesa tries to talk directly to the GPU.
|
||||
PrivateDevices = false;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = "tmpfs";
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "strict";
|
||||
RemoveIPC = true;
|
||||
UMask = "0077";
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
"~@resources"
|
||||
];
|
||||
};
|
||||
};
|
||||
})
|
||||
|
|
Loading…
Reference in New Issue