nixos/clash: add cfg.tunMode
This commit is contained in:
parent
7d47e189f8
commit
563d7c4851
1 changed files with 53 additions and 39 deletions
|
@ -36,6 +36,11 @@ in {
|
||||||
type = lib.types.nullOr lib.types.str;
|
type = lib.types.nullOr lib.types.str;
|
||||||
description = "Extra command line options to use.";
|
description = "Extra command line options to use.";
|
||||||
};
|
};
|
||||||
|
tunMode = lib.mkEnableOption ''
|
||||||
|
Whether to grant necessary permission for Clash's systemd service for TUN mode to function properly.
|
||||||
|
|
||||||
|
Keep in mind, that you still need to enable TUN mode manually in Clash's configuration.
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
config = lib.mkIf cfg.enable {
|
config = lib.mkIf cfg.enable {
|
||||||
|
@ -45,7 +50,8 @@ in {
|
||||||
documentation = ["https://clash.wiki/" "https://wiki.metacubex.one/"];
|
documentation = ["https://clash.wiki/" "https://wiki.metacubex.one/"];
|
||||||
after = ["network-online.target"];
|
after = ["network-online.target"];
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = ["multi-user.target"];
|
||||||
serviceConfig = {
|
serviceConfig =
|
||||||
|
{
|
||||||
ExecStart = builtins.concatStringsSep " " [
|
ExecStart = builtins.concatStringsSep " " [
|
||||||
(lib.getExe cfg.package)
|
(lib.getExe cfg.package)
|
||||||
"-d /var/lib/private/clash"
|
"-d /var/lib/private/clash"
|
||||||
|
@ -59,6 +65,7 @@ in {
|
||||||
LoadCredential = "config.yaml:${cfg.configFile}";
|
LoadCredential = "config.yaml:${cfg.configFile}";
|
||||||
|
|
||||||
### Hardening
|
### Hardening
|
||||||
|
AmbientCapabilities = "";
|
||||||
CapabilityBoundingSet = "";
|
CapabilityBoundingSet = "";
|
||||||
DeviceAllow = "";
|
DeviceAllow = "";
|
||||||
LockPersonality = true;
|
LockPersonality = true;
|
||||||
|
@ -85,6 +92,13 @@ in {
|
||||||
SystemCallArchitectures = "native";
|
SystemCallArchitectures = "native";
|
||||||
SystemCallFilter = "@system-service bpf";
|
SystemCallFilter = "@system-service bpf";
|
||||||
UMask = "0077";
|
UMask = "0077";
|
||||||
|
}
|
||||||
|
// lib.optionalAttrs cfg.tunMode {
|
||||||
|
AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
|
||||||
|
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
|
||||||
|
PrivateDevices = false;
|
||||||
|
PrivateUsers = false;
|
||||||
|
RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
Loading…
Reference in a new issue