Allow AF_UNIX sockets for dmarc reporter and allow group access

This is required to use redis over UNIX domain sockets.
2025-08-07 23:41:43 +02:00
parent eb656cd361
commit aa06b2f489
1 changed files with 4 additions and 0 deletions
--- a/mail-server/rspamd.nix
+++ b/mail-server/rspamd.nix
@@ -235,10 +235,14 @@ in
        RestrictAddressFamilies = [
          "AF_INET"
          "AF_INET6"
+          "AF_UNIX"
        ];
        RestrictNamespaces = true;
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
+        SupplementaryGroups = lib.optionals cfg.redis.configureLocally [
+          config.services.redis.servers.rspamd.group
+        ];
        SystemCallArchitectures = "native";
        SystemCallFilter = [
          "@system-service"