From 89f5cbb27f144deff6d6fe0e6f17a97c1cee221f Mon Sep 17 00:00:00 2001
From: HHR2020 <76608828+HHR2020@users.noreply.github.com>
Date: Sat, 22 Aug 2026 16:35:51 +0800
Subject: [PATCH] nixos/cloudflare-warp: add BindReadOnlyPaths for nftables
 executable

---
 nixos/modules/services/networking/cloudflare-warp.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/services/networking/cloudflare-warp.nix b/nixos/modules/services/networking/cloudflare-warp.nix
index 9cd946903adc..0d7a1a987b51 100644
--- a/nixos/modules/services/networking/cloudflare-warp.nix
+++ b/nixos/modules/services/networking/cloudflare-warp.nix
@@ -73,6 +73,8 @@ in
             "${cfg.rootDir}"
             "/etc/resolv.conf"
           ];
+          # warp-svc uses this absolute FHS path instead of looking up nft in PATH.
+          BindReadOnlyPaths = [ "${lib.getExe pkgs.nftables}:/usr/sbin/nft" ];
           CapabilityBoundingSet = caps;
           AmbientCapabilities = caps;
           Restart = "always";