diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix index 41ee63a9603..bc69102ba39 100644 --- a/nixos/modules/misc/ids.nix +++ b/nixos/modules/misc/ids.nix @@ -58,7 +58,6 @@ #utmp = 29; # unused ddclient = 30; davfs2 = 31; - privoxy = 32; #disnix = 33; # unused osgi = 34; tor = 35; @@ -322,7 +321,6 @@ utmp = 29; #ddclient = 30; # unused davfs2 = 31; - privoxy = 32; disnix = 33; osgi = 34; tor = 35; diff --git a/nixos/modules/services/networking/privoxy.nix b/nixos/modules/services/networking/privoxy.nix index 94beb78ef5a..49ca839a2c3 100644 --- a/nixos/modules/services/networking/privoxy.nix +++ b/nixos/modules/services/networking/privoxy.nix @@ -6,8 +6,6 @@ let inherit (pkgs) privoxy; - privoxyUser = "privoxy"; - cfg = config.services.privoxy; confFile = pkgs.writeText "privoxy.conf" '' @@ -88,18 +86,25 @@ in ###### implementation config = mkIf cfg.enable { - - users.extraUsers = singleton - { name = privoxyUser; - uid = config.ids.uids.privoxy; - description = "Privoxy daemon user"; - }; + + users.users.privoxy = { + isSystemUser = true; + home = "/var/empty"; + group = "privoxy"; + }; + + users.groups.privoxy = {}; systemd.services.privoxy = { description = "Filtering web proxy"; after = [ "network.target" "nss-lookup.target" ]; wantedBy = [ "multi-user.target" ]; - serviceConfig.ExecStart = "${privoxy}/sbin/privoxy --no-daemon --user ${privoxyUser} ${confFile}"; + serviceConfig.ExecStart = "${privoxy}/bin/privoxy --no-daemon --user privoxy ${confFile}"; + + serviceConfig.PrivateDevices = true; + serviceConfig.PrivateTmp = true; + serviceConfig.ProtectHome = true; + serviceConfig.ProtectSystem = "full"; }; };