From 547d6dc4731b04a240048b0b95c0ea12e0d1f6bd Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Fri, 9 Jan 2026 20:36:36 -0600
Subject: lots of changes, including revamp of network services boot chain on
 mercury

---
 modules/services/nixos/bluetooth.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'modules/services/nixos/bluetooth.nix')

diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix
index a86b5b3..bdcaa00 100644
--- a/modules/services/nixos/bluetooth.nix
+++ b/modules/services/nixos/bluetooth.nix
@@ -12,6 +12,18 @@ in
       powerOnBoot = true;
     };
 
+    # hardening (down to 2.1 OK)
+    systemd.services."bluetooth".serviceConfig = {
+      IPAddressDeny = "any";
+      ProtectHostname = true;
+      ProtectKernelTunables = lib.mkForce true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = lib.mkForce true;
+      RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"];
+      ProtectClock = true;
+      ProcSubset = "pid";
+    };
+
     environment.systemPackages = [
       (lib.mkIf cfg.blueman.enable pkgs.blueman)
       (lib.mkIf cfg.bluetuith.enable pkgs.bluetuith)
-- 
cgit v1.3.1