blob: bdcaa00e439f6dfab599ac69502955390a63bd93 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
{
pkgs,
lib,
config,
...
}: let
cfg = config.collinux.services.bluetooth;
in
lib.mkIf cfg.enable {
hardware.bluetooth = {
enable = true;
powerOnBoot = true;
};
# hardening (down to 2.1 OK)
systemd.services."bluetooth".serviceConfig = {
IPAddressDeny = "any";
ProtectHostname = true;
ProtectKernelTunables = lib.mkForce true;
ProtectKernelLogs = true;
ProtectKernelModules = lib.mkForce true;
RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"];
ProtectClock = true;
ProcSubset = "pid";
};
environment.systemPackages = [
(lib.mkIf cfg.blueman.enable pkgs.blueman)
(lib.mkIf cfg.bluetuith.enable pkgs.bluetuith)
];
}
|
