vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

render squid's users file from this hive's proxy credentials

Browse source
This commit is contained in:
atlas 2026-10-28 13:02:25 +01:00 • committed by mara
commit 52d532ff5a
1 changed files with 562 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/host-modules/hive-c0re/default.nix
View file

@ -347,7 +347,11 @@ in
# needs access to the rest of c0re's state — that separation
# means c0re itself needs an explicit carve-out to write there.
ProtectSystem = "strict";
ReadWritePaths = [ "/var/lib/hive-gateway/conf" ];
# `-` so a host without the squid users directory still starts the daemon.
ReadWritePaths = [
"/var/lib/hive-gateway/conf"
"-${builtins.dirOf config.services.hyperhive.squid.usersFile}"
];
ProtectKernelTunables = true; # no sysctl writes
ProtectKernelLogs = true; # no /dev/kmsg access needed
ProtectControlGroups = true; # cgroup writes go through hive-priv, not c0re directly