nixos/nginx: add option enableSandbox

2020-05-12 20:03:29 +03:00
parent aa12fb8adb
commit 94391fce1d
3 changed files with 12 additions and 2 deletions
@@ -463,6 +463,14 @@ in
        '';
      };

+      enableSandbox = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Starting Nginx web server with additional sandbox/hardening options.
+        '';
+      };
+
      user = mkOption {
        type = types.str;
        default = "nginx";
@@ -713,6 +721,7 @@ in
        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
        # Security
        NoNewPrivileges = true;
+      } // optionalAttrs cfg.enableSandbox {
        # Sandboxing
        ProtectSystem = "strict";
        ProtectHome = mkDefault true;