milestone 20: declarative configuration for iac

2026-08-11 23:31:40 +02:00
parent 2f29121e27
commit d76afc147a
74 changed files with 6722 additions and 1949 deletions
@@ -16,6 +16,11 @@ StateDirectoryMode=0700
 LogsDirectory=nxdns
 ConfigurationDirectory=nxdns

+# ConfigurationDirectory creates /etc/nxdns owned by the service user. nxdns
+# never writes there in either authority mode, and in file mode that directory
+# holds the source of truth, so deny the write outright rather than rely on it.
+ReadOnlyPaths=/etc/nxdns
+
 # Port 53 (and 443/853 when the DoH/DoT listeners are enabled).
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
@@ -44,6 +49,9 @@ SystemCallArchitectures=native

 Restart=on-failure
 RestartSec=2
+# Exit 2 is a configuration fault and 64 is a usage error. Neither clears on a
+# retry, so a restart loop only buries the diagnostics already in the journal.
+RestartPreventExitStatus=2 64

 [Install]
 WantedBy=multi-user.target