cyplo/dotfiles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add snowflake to vultr

Browse source
This commit is contained in:
Cyryl Płotnicki 2022-03-05 10:27:03 +00:00
parent e082fb235c
commit fc40629c73
2 changed files with 45 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
nixos/boxes/vultr1/default.nix
View file

@ -4,14 +4,15 @@
imports = [
./vultr-boot.nix
../../server-security.nix
../../tailscale.nix
./tailscale-vultr1.nix
../cli.nix
./nginx.nix
./folding.nix
./matrix-front.nix
./nginx.nix
./search.nix
./snowflake.nix
../cli.nix
../../server-security.nix
../../tailscale.nix
];
systemd.extraConfig = ''

40
nixos/boxes/vultr1/snowflake.nix Normal file
View file

@ -0,0 +1,40 @@
{ config, pkgs, lib, ... }:
{
containers.snowflake = {
autoStart = true;
ephemeral = true;
config = {
systemd.services.snowflake = {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
IPAccounting = "yes";
ExecStart = "${pkgs.snowflake}/bin/proxy";
DynamicUser = "yes";
# Read-only filesystem
ProtectSystem = "strict";
PrivateDevices = "yes";
ProtectKernelTunables = "yes";
ProtectControlGroups = "yes";
ProtectHome = "yes";
# Deny access to as many things as possible
NoNewPrivileges = "yes";
PrivateUsers = "yes";
LockPersonality = "yes";
MemoryDenyWriteExecute = "yes";
ProtectClock = "yes";
ProtectHostname = "yes";
ProtectKernelLogs = "yes";
ProtectKernelModules = "yes";
RestrictNamespaces = "yes";
RestrictRealtime = "yes";
RestrictSUIDSGID = "yes";
SystemCallArchitectures = "native";
SystemCallFilter = "~@chown @clock @cpu-emulation @debug @module @mount @obsolete @raw-io @reboot @setuid @swap @privileged @resources";
CapabilityBoundingSet = "";
ProtectProc = "invisible";
ProcSubset = "pid";
};
};
};
};
}