surtr: matrix: isolation

1 files changed, 44 insertions, 0 deletions

diff --git a/hosts/surtr/matrix/default.nix b/hosts/surtr/matrix/default.nix
index 0c48a243..9376620c 100644
--- a/hosts/surtr/matrix/default.nix
+++ b/hosts/surtr/matrix/default.nix
@@ -80,6 +80,10 @@ with lib;
     };
 
     systemd.services.matrix-synapse = {
+      unitConfig = {
+        wants = ["postgresql.service"];
+      };
+
       serviceConfig = {
         LoadCredential = [
           "synapse.li.key.pem:${config.security.acme.certs."synapse.li".directory}/key.pem"
@@ -87,6 +91,46 @@ with lib;
           "registration.yaml:${config.sops.secrets."matrix-synapse-registration.yaml".path}"
           "turn-secret.yaml:${config.sops.secrets."matrix-synapse-turn-secret.yaml".path}"
         ];
+
+        RuntimeDirectory = "matrix-synapse";
+        StateDirectory = "matrix-synapse";
+
+        PrivateTmp = true;
+        PrivateDevices = true;
+
+        CapabilityBoundingSet = [];
+        AmbientCapabilities = [];
+
+        ProtectSystem = "strict";
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        ProtectClock = true;
+        ProtectHostname = true;
+
+        ProtectHome = "tmpfs";
+        ProtectKernelLogs = true;
+
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+
+        PrivateNetwork = false;
+        RestrictAddressFamily = ["AF_INET" "AF_INET6" "AF_UNIX"];
+        IPAddressAllow = "any";
+
+        SystemCallArchitectures = "native";
+        SystemCallFilter = ["@system-service" "~@privileged @resources @obsolete"];
+        
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        NoNewPrivileges = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        PrivateUsers = true;
+        MemoryDenyWriteExecute = false;
+
+        ReadWritePaths = ["/var/run/postgresql"];
       };
     };