1 files changed, 24 insertions, 5 deletions

diff --git a/hosts/surtr/http/webdav/default.nix b/hosts/surtr/http/webdav/default.nix
index 1da411d3..0443bc97 100644
--- a/hosts/surtr/http/webdav/default.nix
+++ b/hosts/surtr/http/webdav/default.nix
@@ -76,11 +76,30 @@ in {
       };
     };
 
-    systemd.services.nginx.serviceConfig.LoadCredential = [
-      "webdav.141.li.key.pem:${config.security.acme.certs."webdav.141.li".directory}/key.pem"
-      "webdav.141.li.pem:${config.security.acme.certs."webdav.141.li".directory}/fullchain.pem"
-      "webdav.141.li.chain.pem:${config.security.acme.certs."webdav.141.li".directory}/chain.pem"
-    ];
+    systemd.services.nginx.serviceConfig = {
+      LoadCredential = [
+        "webdav.141.li.key.pem:${config.security.acme.certs."webdav.141.li".directory}/key.pem"
+        "webdav.141.li.pem:${config.security.acme.certs."webdav.141.li".directory}/fullchain.pem"
+        "webdav.141.li.chain.pem:${config.security.acme.certs."webdav.141.li".directory}/chain.pem"
+      ];
+
+      NoNewPrivileges = lib.mkForce false;
+      PrivateDevices = lib.mkForce false;
+      ProtectHostname = lib.mkForce false;
+      ProtectKernelTunables = lib.mkForce false;
+      ProtectKernelModules = lib.mkForce false;
+      RestrictAddressFamilies = lib.mkForce [ ];
+      LockPersonality = lib.mkForce false;
+      MemoryDenyWriteExecute = lib.mkForce false;
+      RestrictRealtime = lib.mkForce false;
+      RestrictSUIDSGID = lib.mkForce false;
+      SystemCallArchitectures = lib.mkForce "";
+      ProtectClock = lib.mkForce false;
+      ProtectKernelLogs = lib.mkForce false;
+      RestrictNamespaces = lib.mkForce false;
+      SystemCallFilter = lib.mkForce "";
+      ReadWritePaths = [ "/srv/files" ];
+    };
 
 
     # services.uwsgi.instance.vassals.webdav = {