nixbitcoin
81a1c3f908
service hardening: Add CapabilityBoundingSets
...
Whitelist with exceptions in webindex and onion-chef
2020-05-22 11:29:54 +00:00
nixbitcoin
3cd61506e0
webindex & onion-chef: Run non-network-facing services in PrivateNetwork
2020-05-22 11:29:07 +00:00
nixbitcoin
7c70dd43ac
All modules: Give service config precedence over defaultHardening
...
With '//' the latter takes precedence over the former in case of
equally named attributes.
2020-05-22 08:08:27 +00:00
Erik Arvstedt
60c732a6a1
onion-chef: set RemainAfterExit, fix tor dependency
...
This better fits the semantics of this unit and allows for easier
automated testing whether the service is active.
wantedBy = bindsTo = after = tor.service is the simplest way to ensure
that this unit is always running/restarted in lockstep with tor.
Previously, onion-chef would have stayed inactive in the case
that tor was stopped and then later restarted.
2020-01-12 20:02:02 +01:00
Erik Arvstedt
f0a36fe0c7
add 'nix-bitcoin-services' option
...
1. Makes the content easily accessible for module users
2. Avoids needlessly recalculating the attrset in every client module
2020-01-12 20:02:00 +01:00
Jonas Nick
eaaf8e9aab
Use IPAddress{Allow,Deny} by default for systemd services
2019-04-28 13:15:17 +00:00
Jonas Nick
a089d65d25
Move service hardening flags into separate file
2019-04-28 13:15:12 +00:00
Jonas Nick
aba1b7dfc2
Give operator access to onion hostnames through new onion-manager module
2019-04-02 15:02:31 +00:00
