nixos/cloudflare-warp: add BindReadOnlyPaths for nftables executable

2026-08-26 02:05:02 +00:00 · 2026-08-22 16:35:51 +08:00
parent 9a32567cd7
commit 89f5cbb27f
1 changed files with 2 additions and 0 deletions
--- a/nixos/modules/services/networking/cloudflare-warp.nix
+++ b/nixos/modules/services/networking/cloudflare-warp.nix
@@ -73,6 +73,8 @@ in
            "${cfg.rootDir}"
            "/etc/resolv.conf"
          ];
+          # warp-svc uses this absolute FHS path instead of looking up nft in PATH.
+          BindReadOnlyPaths = [ "${lib.getExe pkgs.nftables}:/usr/sbin/nft" ];
          CapabilityBoundingSet = caps;
          AmbientCapabilities = caps;
          Restart = "always";