nixos/clash: add cfg.tunMode

nixos/modules/services/clash.nix

@@ -36,6 +36,11 @@ in {
       type = lib.types.nullOr lib.types.str;
       description = "Extra command line options to use.";
     };
+    tunMode = lib.mkEnableOption ''
+      Whether to grant necessary permission for Clash's systemd service for TUN mode to function properly.
+
+      Keep in mind, that you still need to enable TUN mode manually in Clash's configuration.
+    '';
   };
 
   config = lib.mkIf cfg.enable {
@@ -45,7 +50,8 @@ in {
       documentation = ["https://clash.wiki/" "https://wiki.metacubex.one/"];
       after = ["network-online.target"];
       wantedBy = ["multi-user.target"];
-      serviceConfig = {
+      serviceConfig =
+        {
           ExecStart = builtins.concatStringsSep " " [
             (lib.getExe cfg.package)
             "-d /var/lib/private/clash"
@@ -59,6 +65,7 @@ in {
           LoadCredential = "config.yaml:${cfg.configFile}";
 
           ### Hardening
+          AmbientCapabilities = "";
           CapabilityBoundingSet = "";
           DeviceAllow = "";
           LockPersonality = true;
@@ -85,6 +92,13 @@ in {
           SystemCallArchitectures = "native";
           SystemCallFilter = "@system-service bpf";
           UMask = "0077";
+        }
+        // lib.optionalAttrs cfg.tunMode {
+          AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
+          CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
+          PrivateDevices = false;
+          PrivateUsers = false;
+          RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK";
         };
     };
   };