@@ -99,9 +99,22 @@ in
9999 LockFile = "/run/geoipupdate/.lock";
100100 };
101101
102+ systemd.services.geoipupdate-create-db-dir = {
103+ serviceConfig.Type = "oneshot";
104+ script = ''
105+ mkdir -p ${cfg.settings.DatabaseDirectory}
106+ chmod 0755 ${cfg.settings.DatabaseDirectory}
107+ '';
108+ };
109+
102110 systemd.services.geoipupdate = {
103111 description = "GeoIP Updater";
104− after = [ "network-online.target" "nss-lookup.target" ];
112+ requires = [ "geoipupdate-create-db-dir.service" ];
113+ after = [
114+ "geoipupdate-create-db-dir.service"
115+ "network-online.target"
116+ "nss-lookup.target"
117+ ];
105118 wants = [ "network-online.target" ];
106119 startAt = cfg.interval;
107120 serviceConfig = {
@@ -119,11 +132,9 @@ in
119132 };
120133 };
121134
122− geoipupdateConf = pkgs.writeText "discourse.conf" (geoipupdateKeyValue cfg.settings);
135+ geoipupdateConf = pkgs.writeText "geoipupdate.conf" (geoipupdateKeyValue cfg.settings);
123136
124137 script = ''
125− mkdir -p "${cfg.settings.DatabaseDirectory}"
126− chmod 755 "${cfg.settings.DatabaseDirectory}"
127138 chown geoip "${cfg.settings.DatabaseDirectory}"
128139
129140 cp ${geoipupdateConf} /run/geoipupdate/GeoIP.conf
@@ -139,7 +150,38 @@ in
139150 ReadWritePaths = cfg.settings.DatabaseDirectory;
140151 RuntimeDirectory = "geoipupdate";
141152 RuntimeDirectoryMode = 0700;
153+ CapabilityBoundingSet = "";
154+ PrivateDevices = true;
155+ PrivateMounts = true;
156+ PrivateUsers = true;
157+ ProtectClock = true;
158+ ProtectControlGroups = true;
159+ ProtectHome = true;
160+ ProtectHostname = true;
161+ ProtectKernelLogs = true;
162+ ProtectKernelModules = true;
163+ ProtectKernelTunables = true;
164+ ProtectProc = "invisible";
165+ ProcSubset = "pid";
166+ SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
167+ RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
168+ RestrictRealtime = true;
169+ RestrictNamespaces = true;
170+ MemoryDenyWriteExecute = true;
171+ LockPersonality = true;
172+ SystemCallArchitectures = "native";
173+ };
174+ };
175+
176+ systemd.timers.geoipupdate-initial-run = {
177+ wantedBy = [ "timers.target" ];
178+ unitConfig.ConditionPathExists = "!${cfg.settings.DatabaseDirectory}";
179+ timerConfig = {
180+ Unit = "geoipupdate.service";
181+ OnActiveSec = 0;
142182 };
143183 };
144184 };
185+
186+ meta.maintainers = [ lib.maintainers.talyz ];
145187}