kris/nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add openclaw sandboxed user, sudo policy, fs restrictions, docker proxy, watchdog

Browse Source
This commit is contained in:
Kris
2026-03-14 17:02:37 +02:00
parent 2a16184fba
commit eebf3f6159
6 changed files with 181 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
modules/openclaw-fs.nix Normal file
View File

@@ -0,0 +1,29 @@
{ ... }:
{
fileSystems =
let
bindRO = src: {
device = src;
fsType = "none";
options = [ "bind" "ro" ];
};
bindHide = src: {
device = "tmpfs";
fsType = "tmpfs";
options = [ "size=0" "mode=000" ];
};
in
{
"/home/openclaw/private/AT Protocol" = bindHide "/private/AT Protocol";
"/home/openclaw/private/cloudflared" = bindHide "/private/cloudflared";
"/home/openclaw/private/vaultwarden" = bindHide "/private/vaultwarden";
"/home/openclaw/protected" = bindHide "/protected";
};
systemd.tmpfiles.rules = [
"d /home/openclaw/private 0750 openclaw openclaw -"
"d /home/openclaw/protected 0000 root root -"
"f /home/openclaw/private/tangled.env 0000 root root -"
"f /home/openclaw/private/cloudflared.pem 0000 root root -"
];
}