oysteikt/nix-dotfiles
oysteikt/nix-dotfiles
2
1
Fork 0
Code Issues Pull Requests Activity

common/thermald: enable

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit 2024-12-03 13:21:59 +01:00
parent 8a41a97bbf
commit 020bc31713
Signed by: oysteikt
GPG Key ID: 9F2F7D8250F35146
2 changed files with 47 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
hosts/common/default.nix
View File

@ -22,6 +22,7 @@ in {
./services/resolved.nix ./services/resolved.nix
./services/smartd.nix ./services/smartd.nix
./services/systemd-lock-handler.nix ./services/systemd-lock-handler.nix
./services/thermald.nix
./services/uptimed.nix ./services/uptimed.nix
./services/userborn.nix ./services/userborn.nix
./services/xserver.nix ./services/xserver.nix

46
hosts/common/services/thermald.nix Normal file
View File

@ -0,0 +1,46 @@
{ config, lib, ... }:
{
services.thermald.enable = true;
systemd.services.thermald = lib.mkIf config.services.thermald.enable {
documentation = [ "man:thermald(8)" "man:thermal-conf.xml(5)" ];
unitConfig.ConditionVirtualization = "no";
serviceConfig = {
PrivateUsers = true;
PrivateNetwork = true;
# AmbientCapabilities = [ "" ];
# CapabilityBoundingSet = [ "" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
# PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = "yes";
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true; #?
ProtectProc = "invisible"; #?
ProtectSystem = "strict";
RemoveIPC = true;
UMask = "0777";
RestrictNamespaces = true;
# RestrictRealtime = true; #?
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SocketBindDeny = [ "any" ];
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
];
};
};
}