colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

wg-home-refresh: use the sandboxed wireguard-tools

Browse Source
This commit is contained in:
Colin
2024-08-09 23:52:31 +00:00
parent 3d773fe375
commit f986936bbd
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
modules/vpn.nix
View File

@@ -185,7 +185,7 @@ let
# periodically re-apply peers, to ensure DNS mappings stay fresh # periodically re-apply peers, to ensure DNS mappings stay fresh
# borrowed from <repo:nixos/nixpkgs:nixos/modules/services/networking/wireguard.nix> # borrowed from <repo:nixos/nixpkgs:nixos/modules/services/networking/wireguard.nix>
wantedBy = [ "network.target" ]; wantedBy = [ "network.target" ];
path = with pkgs; [ wireguard-tools ]; path = [ config.sane.programs.wireguard-tools.package ];
serviceConfig.Restart = "always"; serviceConfig.Restart = "always";
serviceConfig.RestartSec = "60"; #< retry delay when we fail (because e.g. there's no network) serviceConfig.RestartSec = "60"; #< retry delay when we fail (because e.g. there's no network)
serviceConfig.Type = "simple"; serviceConfig.Type = "simple";
@@ -215,6 +215,7 @@ let
serviceConfig.SystemCallArchitectures = "native"; serviceConfig.SystemCallArchitectures = "native";
serviceConfig.SystemCallFilter = [ serviceConfig.SystemCallFilter = [
"@system-service" "@system-service"
"@sandbox"
"~@chown" "~@chown"
"~@cpu-emulation" "~@cpu-emulation"
"~@keyring" "~@keyring"