systemd hardening

module.nix

@@ -83,23 +83,39 @@ in
 
   config = lib.mkMerge [
     (lib.mkIf cfg.enable {
+      users = {
+        users.greg = {
+          isNormalUser = true;
+          group = "greg";
+          uid = 2000;
+          description = "loud gym bro";
+        };
+        groups.greg.gid = 2000;
+      };
+
       systemd.user.services.greg-ng = {
         description = "greg-ng, an mpv based media player";
         wantedBy = [ "graphical-session.target" ];
         partOf = [ "graphical-session.target" ];
-        environment.RUST_LOG = lib.mkIf cfg.enableDebug "greg_ng=trace,mpvipc=trace";
+        environment = {
+          RUST_LOG = lib.mkIf cfg.enableDebug "greg_ng=trace,mpvipc=trace";
+        };
         serviceConfig = {
           Type = "simple";
           ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}";
           Restart = "always";
           RestartSec = 3;
 
+          IPAddressDeny =
+            lib.optionals (lib.elem cfg.settings.host [ null "localhost" "127.0.0.1" ]) [ "any" ];
+
           RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+
           AmbientCapabilities = [ "" ];
           CapabilityBoundingSet = [ "" ];
           DeviceAllow = [ "" ];
           LockPersonality = true;
-          # Might work, but wouldn't bet on it with embedded lua in mpv
+          # Might work, but wouldn't bet on it with embedded scripting lang in mpv
           MemoryDenyWriteExecute = false;
           NoNewPrivileges = true;
           # MPV and mesa tries to talk directly to the GPU.
@@ -110,14 +126,13 @@ in
           ProcSubset = "pid";
           ProtectClock = true;
           ProtectControlGroups = true;
-          # MPV wants ~/.cache
+          ProtectHome = "tmpfs";
-          ProtectHome = false;
           ProtectHostname = true;
           ProtectKernelLogs = true;
           ProtectKernelModules = true;
           ProtectKernelTunables = true;
           ProtectProc = "invisible";
-          ProtectSystem = "full";
+          ProtectSystem = "strict";
           RemoveIPC = true;
           UMask = "0077";
           RestrictNamespaces = true;
@@ -152,16 +167,6 @@ in
         extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
       };
 
-      users = {
-        users.greg = {
-          isNormalUser = true;
-          group = "greg";
-          uid = 2000;
-          description = "loud gym bro";
-        };
-        groups.greg.gid = 2000;
-      };
-
       services.greetd = {
         enable = true;
         settings = rec {

src/main.rs

@@ -66,9 +66,7 @@ async fn main() -> anyhow::Result<()> {
     })
     .await?;
 
-    if let Err(e) = show_grzegorz_image(mpv.clone()).await {
+    show_grzegorz_image(mpv.clone()).await?;
-      log::warn!("Could not show Grzegorz image: {}", e);
-    }
 
     let addr = SocketAddr::new(resolve(&args.host).await?, args.port);
     log::info!("Starting API on {}", addr);