bertof/nix-dotfiles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Lint and format

Browse source
This commit is contained in:
Filippo Berto 2022-06-30 09:30:21 +02:00
parent 9277dc6907
commit 9c0392359b
5 changed files with 68 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

84
loki/configuration.nix
View file

@ -98,16 +98,19 @@ with lib;
load printers = no
smb encrypt = required
'';
shares = let common = {
"public" = "no";
"writeable" = "yes";
"create mask" = "0700";
"directory mask" = "2700";
"browseable" = "yes";
"guest ok" = "no";
"read only" = "no";
"force group" = "users";
}; in
shares =
let
common = {
"public" = "no";
"writeable" = "yes";
"create mask" = "0700";
"directory mask" = "2700";
"browseable" = "yes";
"guest ok" = "no";
"read only" = "no";
"force group" = "users";
};
in
{
bertof = recursiveUpdate common {
path = "/mnt/raid0/bertof";
@ -238,36 +241,39 @@ with lib;
systemd.packages = with pkgs; [ syncthing ];
systemd.services = let common = {
documentation = [ "man:syncthing(1)" ];
startLimitIntervalSec = 60;
startLimitBurst = 4;
after = [ "network.target" ];
environment = { STNORESTART = "yes"; STNOUPGRADE = "yes"; };
wantedBy = [ "default.target" ];
serviceConfig = {
Restart = "on-failure";
RestartSec = 1;
SuccessExitStatus = "3 4";
RestartForceExitStatus = "3 4";
systemd.services =
let
common = {
documentation = [ "man:syncthing(1)" ];
startLimitIntervalSec = 60;
startLimitBurst = 4;
after = [ "network.target" ];
environment = { STNORESTART = "yes"; STNOUPGRADE = "yes"; };
wantedBy = [ "default.target" ];
serviceConfig = {
Restart = "on-failure";
RestartSec = 1;
SuccessExitStatus = "3 4";
RestartForceExitStatus = "3 4";
Group = config.ids.gids.users;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
CapabilityBoundingSet = [ "~CAP_SYS_PTRACE" "~CAP_SYS_ADMIN" "~CAP_SETGID" "~CAP_SETUID" "~CAP_SETPCAP" "~CAP_SYS_TIME" "~CAP_KILL" ];
};
}; in
Group = config.ids.gids.users;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
CapabilityBoundingSet = [ "~CAP_SYS_PTRACE" "~CAP_SYS_ADMIN" "~CAP_SETGID" "~CAP_SETUID" "~CAP_SETPCAP" "~CAP_SYS_TIME" "~CAP_KILL" ];
};
};
in
{
syncthing-bertof = recursiveUpdate common {
description = "Syncthing service bertof";

2
loki/hardware-configuration.nix
View file

@ -16,7 +16,7 @@
fileSystems."/" =
{
device = "/dev/disk/by-uuid/44c53e75-a00d-47bc-a99b-2544fe513e51";
device = "/dev/disk/by-uuid/44c53e75-a00d-47bc-a99b-2544fe513e51";
fsType = "btrfs";
};