{ config, lib, pkgs, ... }: with lib; let defaultHardening = { PrivateTmp = "true"; ProtectSystem = "full"; ProtectHome = "true"; NoNewPrivileges = "true"; PrivateDevices = "true"; MemoryDenyWriteExecute = "true"; ProtectKernelTunables = "true"; ProtectKernelModules = "true"; ProtectControlGroups = "true"; RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6"; RestrictNamespaces = "true"; LockPersonality = "true"; IPAddressDeny = "any"; }; in { inherit defaultHardening; # nodejs applications apparently rely on memory write execute nodejs = { MemoryDenyWriteExecute = "false"; }; # Allow tor traffic. Allow takes precedence over Deny. allowTor = { IPAddressAllow = "127.0.0.1/32 ::1/128"; }; # Allow any traffic allowAnyIP = { IPAddressAllow = "any"; }; enforceTor = mkOption { type = types.bool; default = false; description = '' "Whether to force Tor on a service by only allowing connections from and to 127.0.0.1;"; ''; }; }