Use IPAddress{Allow,Deny} by default for systemd services

2019-04-28 13:15:17 +00:00
parent d9533edad1
commit eaaf8e9aab
12 changed files with 79 additions and 22 deletions
@@ -3,7 +3,7 @@
 with lib;

 let
-  nix-bitcoin-services = import ./nix-bitcoin-services.nix;
+  nix-bitcoin-services = pkgs.callPackage ./nix-bitcoin-services.nix { };
  cfg = config.services.nix-bitcoin-webindex;
  indexFile = pkgs.writeText "index.html" ''
    <html>
@@ -44,6 +44,7 @@ in {
        If enabled, the webindex service will be installed.
      '';
    };
+    enforceTor =  nix-bitcoin-services.enforceTor;
  };

  config = mkIf cfg.enable {
@@ -81,7 +82,11 @@ in {
        RemainAfterExit="yes";
        Restart = "on-failure";
        RestartSec = "10s";
-      } // nix-bitcoin-services.defaultHardening;
+      } // nix-bitcoin-services.defaultHardening
+        // (if cfg.enforceTor
+          then nix-bitcoin-services.allowTor
+          else nix-bitcoin-services.allowAnyIP
+        );
    };
  };
 }