nixos/mihomo: add an option for processes info

}:

let

  cfg = config.services.mihomo;

  AmbientCapabilities =

    lib.optional cfg.tunMode "CAP_NET_ADMIN"

    ++ lib.optionals cfg.processesInfo [

      "CAP_DAC_READ_SEARCH"

      "CAP_SYS_PTRACE"

    ];

  CapabilityBoundingSet = AmbientCapabilities;

in

{

  options.services.mihomo = {

    };

    tunMode = lib.mkEnableOption ''

      necessary permission for Mihomo's systemd service for TUN mode to function properly.

      necessary capabilities for Mihomo's systemd service for TUN mode to function properly.

      Keep in mind, that you still need to enable TUN mode manually in Mihomo's configuration

    '';

    processesInfo = lib.mkEnableOption ''

      necessary capabilities for rules about process information such as `process-name`

    '';

  };

  config = lib.mkIf cfg.enable {

        LoadCredential = "config.yaml:${cfg.configFile}";

        ### Hardening

        AmbientCapabilities = "";

        CapabilityBoundingSet = "";

        inherit AmbientCapabilities CapabilityBoundingSet;

        DeviceAllow = "";

        LockPersonality = true;

        MemoryDenyWriteExecute = true;

        UMask = "0077";

      }

      // lib.optionalAttrs cfg.tunMode {

        AmbientCapabilities = "CAP_NET_ADMIN";

        CapabilityBoundingSet = "CAP_NET_ADMIN";

        PrivateDevices = false;

        PrivateUsers = false;

        RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK";