lnd: add strict hardening

Add ProtectSystem=strict, remove PermissionStartOnly. Extract the section of postStart that needs secrets dir write access into a separate script with full privileges. Simplify preStart and fix dataDir quoting.
2020-05-22 16:13:58 +00:00
parent a040e52854
commit 5f3f362451
3 changed files with 63 additions and 56 deletions
@@ -21,7 +21,7 @@
  options = {
    nix-bitcoin-services = lib.mkOption {
      readOnly = true;
-      default = import ./nix-bitcoin-services.nix lib;
+      default = import ./nix-bitcoin-services.nix lib pkgs;
    };
  };