mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
Ryan Yin
8084f25e6f
Apply hdparm -B 255 -S 0 whenever a disk appears, which also covers the re-add after a bridge reset, instead of a boot oneshot plus an hourly timer. Drop -J 0: hdparm has always aborted it without --please-destroy-my-drive, and wdidle3 already reads disabled on both disks (it is persistent firmware state). This was the last user of mylib.systemdHardening.privilegedOneshot, so remove the preset and its test group. Assisted-by: Claude Code (claude-opus-5-5)
25 lines
564 B
Nix
25 lines
564 B
Nix
let
|
|
sandbox = {
|
|
CapabilityBoundingSet = "";
|
|
NoNewPrivileges = true;
|
|
PrivateDevices = true;
|
|
ProtectSystem = "strict";
|
|
SystemCallFilter = [
|
|
"@system-service"
|
|
"~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @swap"
|
|
];
|
|
};
|
|
in
|
|
{
|
|
# Only 80/443.
|
|
caddy = sandbox // {
|
|
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
|
};
|
|
rustfs = sandbox;
|
|
vmalert-homelab = sandbox;
|
|
# The NPU is allowed through DeviceAllow instead.
|
|
whisper-asr = sandbox // {
|
|
PrivateDevices = false;
|
|
};
|
|
}
|