surtr(tls): ...

1 files changed, 6 insertions, 1 deletions

diff --git a/hosts/surtr/tls.nix b/hosts/surtr/tls.nix
index 9a531930..7c62366a 100644
--- a/hosts/surtr/tls.nix
+++ b/hosts/surtr/tls.nix
@@ -24,6 +24,10 @@ let
       [[ -n "''${commited}" ]] || ${knotCfg.cliWrappers}/bin/knotc zone-abort "${zone}"
     }
 
+    ${pkgs.coreutils}/bin/stat /run/knot/knot.sock
+    ${pkgs.coreutils}/bin/ls -lhaFR /run/knot /run/knot/knot.sock
+    ${pkgs.coreutils}/bin/groups
+
     ${knotCfg.cliWrappers}/bin/knotc zone-begin "${zone}"
     trap abort EXIT
 
@@ -75,8 +79,9 @@ in {
           after = [ "knot.service" ];
           bindsTo = [ "knot.service" ];
           serviceConfig = {
-            BindPaths = ["/run/knot:/run/knot"];
+            ReadWritePaths = ["/run/knot/knot.sock"];
             SupplementaryGroups = ["knot"];
+            RestrictAddressFamilies = ["AF_UNIX"];
           };
         };
       in mapAttrs' (domain: nameValuePair "acme-${domain}") (genAttrs domains serviceAttrset);