30 lines
596 B
Nix
30 lines
596 B
Nix
{ pkgs-pinned, lib, ... }: {
|
|
programs.clash-verge = {
|
|
enable = true;
|
|
package = pkgs-pinned.clash-verge-rev;
|
|
serviceMode = true;
|
|
tunMode = true;
|
|
autoStart = true;
|
|
};
|
|
|
|
systemd.services.clash-verge.serviceConfig = {
|
|
CapabilityBoundingSet = lib.mkForce [
|
|
"CAP_NET_ADMIN"
|
|
"CAP_NET_RAW"
|
|
"CAP_SYS_ADMIN"
|
|
"CAP_DAC_OVERRIDE"
|
|
"CAP_DAC_READ_SEARCH"
|
|
"CAP_SYS_PTRACE"
|
|
"CAP_SETUID"
|
|
"CAP_SETGID"
|
|
"CAP_CHOWN"
|
|
"CAP_MKNOD"
|
|
];
|
|
|
|
AmbientCapabilities = [
|
|
"CAP_DAC_READ_SEARCH"
|
|
"CAP_SYS_PTRACE"
|
|
];
|
|
};
|
|
}
|