Martin Weinelt 506bc7ba02 nixos/nginx: update hardening settings ... - Set an explicit umask that allows u+rwx and g+r. - Adds `ProtectControlGroups` and `ProtectKernelLogs`, there should be no need to access either. - Adds `ProtectClock` to prevent write-access to the system clock. - `ProtectProc` hides processes from other users within the /proc filesystem and `ProcSubSet` hides all files/directories unrelated to the process management of the units process. - Sets `RemoveIPC`, as there is no SysV or POSIX IPC within nginx that I know of. - Restricts the creation of arbitrary namespaces - Adds a reasonable `SystemCallFilter` preventing calls to @privileged, @obsolete and others. And finally applies some sorting based on the order these options appear in systemd.exec(5).		2021-04-30 18:49:43 +02:00
..
default.nix	nixos/nginx: update hardening settings	2021-04-30 18:49:43 +02:00
gitweb.nix
location-options.nix	nginx module: fix typo in proxyWebsockets description	2021-01-31 18:09:41 +01:00
vhost-options.nix	nginx: add vhost.http3	2021-04-18 20:20:24 +02:00