nixos/readeck: add back MemoryDenyWriteExecute

SQLite driver is reverted to its CGO version so this can be enabled
2025-06-05 03:47:00 +08:00 · 2025-06-05 03:47:00 +08:00 · 17f95268f3
commit 17f95268f3
parent 49860b21df
1 changed files with 1 additions and 0 deletions
--- a/nixos/modules/services/web-apps/readeck.nix
+++ b/nixos/modules/services/web-apps/readeck.nix
@ -69,6 +69,7 @@ in
        ExecStart = "${lib.getExe cfg.package} serve -config ${configFile}";
        ProtectSystem = "full";
        SystemCallArchitectures = "native";
+        MemoryDenyWriteExecute = true;
        NoNewPrivileges = true;
        PrivateTmp = true;
        PrivateDevices = true;