Henry-Hiles/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

stuff i guess

Browse source
This commit is contained in:
Henry Hiles 2025-10-24 12:14:48 -04:00
commit 9766e1447a
No known key found for this signature in database
6 changed files with 75 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

52
clients/nova/matrix/zulip.nix
View file

@ -1 +1,51 @@
{ }
{
lib,
pkgs,
config,
...
}:
{
systemd.services.matrix-zulip-bridge = {
description = "matrix-zulip-bridge server";
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
serviceConfig =
let
secretName = "matrix-zulip-bridge-secrets";
in
{
LoadCredential = [
"${secretName}:${config.age.secrets."zulipRegistration.age".path}"
];
ExecStart = "${lib.getExe pkgs.matrix-zulip-bridge} --config /run/credentials/matrix-zulip-bridge.service/${secretName} --owner @quadradical:${config.quad.matrix.domain} ${config.services.matrix-continuwuity.settings.global.well_known.client}";
DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
PrivateDevices = true;
PrivateMounts = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
];
RestrictNamespaces = true;
RestrictRealtime = true;
ProtectHome = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
];
Restart = "always";
RestartSec = 5;
};
};
}