Merge pull request #175439 from Mic92/jellyfin
nixos/jellyfin: better defaults for hardware acceleration
This commit is contained in:
commit
9a020f31aa
|
@ -49,7 +49,10 @@ in
|
|||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
# This is mostly follows: https://github.com/jellyfin/jellyfin/blob/master/fedora/jellyfin.service
|
||||
# Upstream also disable some hardenings when running in LXC, we do the same with the isContainer option
|
||||
serviceConfig = rec {
|
||||
Type = "simple";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
StateDirectory = "jellyfin";
|
||||
|
@ -57,48 +60,50 @@ in
|
|||
CacheDirectory = "jellyfin";
|
||||
CacheDirectoryMode = "0700";
|
||||
UMask = "0077";
|
||||
WorkingDirectory = "/var/lib/jellyfin";
|
||||
ExecStart = "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
|
||||
Restart = "on-failure";
|
||||
TimeoutSec = 15;
|
||||
SuccessExitStatus = ["0" "143"];
|
||||
|
||||
# Security options:
|
||||
|
||||
NoNewPrivileges = true;
|
||||
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = "";
|
||||
|
||||
# ProtectClock= adds DeviceAllow=char-rtc r
|
||||
DeviceAllow = "";
|
||||
|
||||
LockPersonality = true;
|
||||
|
||||
PrivateTmp = true;
|
||||
# Disabled to allow Jellyfin to access hw accel devices endpoints
|
||||
# PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
|
||||
# Disabled as it does not allow Jellyfin to interface with CUDA devices
|
||||
# ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
|
||||
RemoveIPC = true;
|
||||
|
||||
RestrictNamespaces = true;
|
||||
SystemCallArchitectures = "native";
|
||||
# AF_NETLINK needed because Jellyfin monitors the network connection
|
||||
RestrictAddressFamilies = [ "AF_NETLINK" "AF_INET" "AF_INET6" "AF_UNIX" ];
|
||||
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" ];
|
||||
RestrictNamespaces = !config.boot.isContainer;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
ProtectControlGroups = !config.boot.isContainer;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = !config.boot.isContainer;
|
||||
ProtectKernelModules = !config.boot.isContainer;
|
||||
ProtectKernelTunables = !config.boot.isContainer;
|
||||
LockPersonality = true;
|
||||
PrivateTmp = !config.boot.isContainer;
|
||||
# needed for hardware accelaration
|
||||
PrivateDevices = false;
|
||||
PrivateUsers = true;
|
||||
RemoveIPC = true;
|
||||
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallErrorNumber = "EPERM";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"
|
||||
"~@clock"
|
||||
"~@aio"
|
||||
"~@chown"
|
||||
"~@cpu-emulation"
|
||||
"~@debug"
|
||||
"~@keyring"
|
||||
"~@memlock"
|
||||
"~@module"
|
||||
"~@mount"
|
||||
"~@obsolete"
|
||||
"~@privileged"
|
||||
"~@raw-io"
|
||||
"~@reboot"
|
||||
"~@setuid"
|
||||
"~@swap"
|
||||
];
|
||||
SystemCallErrorNumber = "EPERM";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
Loading…
Reference in a new issue