nixos/clash: add cfg.tunMode

This commit is contained in:
Guanran Wang 2024-01-15 19:50:57 +08:00
parent 7d47e189f8
commit 563d7c4851
Signed by: nyancat
SSH key fingerprint: SHA256:8oWGKciPALWut/6WA27oFKofX+6Wtc0gQnsefXLQx/8

View file

@ -36,6 +36,11 @@ in {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
description = "Extra command line options to use."; description = "Extra command line options to use.";
}; };
tunMode = lib.mkEnableOption ''
Whether to grant necessary permission for Clash's systemd service for TUN mode to function properly.
Keep in mind, that you still need to enable TUN mode manually in Clash's configuration.
'';
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
@ -45,7 +50,8 @@ in {
documentation = ["https://clash.wiki/" "https://wiki.metacubex.one/"]; documentation = ["https://clash.wiki/" "https://wiki.metacubex.one/"];
after = ["network-online.target"]; after = ["network-online.target"];
wantedBy = ["multi-user.target"]; wantedBy = ["multi-user.target"];
serviceConfig = { serviceConfig =
{
ExecStart = builtins.concatStringsSep " " [ ExecStart = builtins.concatStringsSep " " [
(lib.getExe cfg.package) (lib.getExe cfg.package)
"-d /var/lib/private/clash" "-d /var/lib/private/clash"
@ -59,6 +65,7 @@ in {
LoadCredential = "config.yaml:${cfg.configFile}"; LoadCredential = "config.yaml:${cfg.configFile}";
### Hardening ### Hardening
AmbientCapabilities = "";
CapabilityBoundingSet = ""; CapabilityBoundingSet = "";
DeviceAllow = ""; DeviceAllow = "";
LockPersonality = true; LockPersonality = true;
@ -85,6 +92,13 @@ in {
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallFilter = "@system-service bpf"; SystemCallFilter = "@system-service bpf";
UMask = "0077"; UMask = "0077";
}
// lib.optionalAttrs cfg.tunMode {
AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
PrivateDevices = false;
PrivateUsers = false;
RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK";
}; };
}; };
}; };