mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
Ryan Yin
8084f25e6f
Apply hdparm -B 255 -S 0 whenever a disk appears, which also covers the re-add after a bridge reset, instead of a boot oneshot plus an hourly timer. Drop -J 0: hdparm has always aborted it without --please-destroy-my-drive, and wdidle3 already reads disabled on both disks (it is persistent firmware state). This was the last user of mylib.systemdHardening.privilegedOneshot, so remove the preset and its test group. Assisted-by: Claude Code (claude-opus-5-5)
22 lines
419 B
Nix
22 lines
419 B
Nix
{ lib, outputs }:
|
|
let
|
|
keys = [
|
|
"CapabilityBoundingSet"
|
|
"NoNewPrivileges"
|
|
"PrivateDevices"
|
|
"ProtectSystem"
|
|
"SystemCallFilter"
|
|
];
|
|
units =
|
|
host: names:
|
|
lib.genAttrs names (
|
|
n: lib.getAttrs keys outputs.nixosConfigurations.${host}.config.systemd.services.${n}.serviceConfig
|
|
);
|
|
in
|
|
units "youko" [
|
|
"caddy"
|
|
"rustfs"
|
|
"vmalert-homelab"
|
|
]
|
|
// units "aquamarine" [ "whisper-asr" ]
|