Commit e394dc22 authored by Marillindië's avatar Marillindië Committed by Emery Hemingway
Browse files

xray: allow binding lower ports 

Set CapabilityBoundingSet, AmbientCapabilities and NoNewPrivileges as described in XTLS/xray-install.
parent 954d3794

nixos/modules/services/networking/xray.nix

+3 −0
Original line number Diff line number Diff line
@@ -90,6 +90,9 @@ with lib; 
      serviceConfig = {

        DynamicUser = true;

        ExecStart = "${cfg.package}/bin/xray -config ${settingsFile}";

        CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";

        AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";

        NoNewPrivileges = true;

      };

    };

  };