privileged port permissions for https

2026-04-03 18:16:29 -05:00
parent ff74205c57
commit 1a7a1189e7
1 changed files with 7 additions and 0 deletions
@@ -2,6 +2,7 @@
  flake.modules.nixos.forgejo = {config, pkgs, lib, ... }:
    let
      cfg = config.forgejo;
+      needsPrivilegedPort = cfg.port < 1024;
    in
    {
      options.forgejo = {
@@ -25,6 +26,12 @@
      config = lib.mkIf cfg.enable {
        networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];

+        systemd.services.forgejo.serviceConfig = lib.mkIf needsPrivilegedPort {
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+          PrivateUsers = lib.mkForce false;
+        };
+
        sops.secrets = {
          "forgejo/secret_key".owner = config.services.forgejo.user;
          "forgejo/internal_token".owner = config.services.forgejo.user;