From cb04781be679f18f37fab8748699317c55f8374d Mon Sep 17 00:00:00 2001
From: Sweetbread <risdeveau@lair.moe>
Date: Mon, 6 Jul 2026 07:45:55 +0300
Subject: [PATCH] vpn: set capabilities

---
 modules/host/vpn.nix | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/modules/host/vpn.nix b/modules/host/vpn.nix
index 6058899..4097abd 100644
--- a/modules/host/vpn.nix
+++ b/modules/host/vpn.nix
@@ -1,8 +1,28 @@
-{
+{ lib, ... }: {
   programs.clash-verge = {
     enable = true;
     serviceMode = true;
     tunMode = true;
     autoStart = true;
   };
+
+  systemd.services.clash-verge.serviceConfig = {
+    CapabilityBoundingSet = lib.mkForce [
+      "CAP_NET_ADMIN"
+      "CAP_NET_RAW"
+      "CAP_SYS_ADMIN"
+      "CAP_DAC_OVERRIDE"
+      "CAP_DAC_READ_SEARCH"
+      "CAP_SYS_PTRACE"
+      "CAP_SETUID"
+      "CAP_SETGID"
+      "CAP_CHOWN"
+      "CAP_MKNOD"
+    ];
+
+    AmbientCapabilities = [
+      "CAP_DAC_READ_SEARCH"
+      "CAP_SYS_PTRACE"
+    ];
+  };
 }