From f2296df8350e3f1b0c1f6b77e023e1faa02d82c8 Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Mon, 31 Jan 2022 18:48:11 +0100
Subject: ...

---
 hosts/surtr/http.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hosts/surtr/http.nix b/hosts/surtr/http.nix
index 5e63a311..11441e2c 100644
--- a/hosts/surtr/http.nix
+++ b/hosts/surtr/http.nix
@@ -60,6 +60,9 @@
         ];
         RuntimeDirectory = lib.mkForce [ "nginx" "nginx-client-bodies" ];
         RuntimeDirectoryMode = "0750";
+
+        SystemCallFilter = lib.mkForce "";
+        ReadWritePaths = [ "/srv/files" ];
       };
     };
   };
-- 
cgit v1.2.3