From e6b778b64a081f9bbbd18bff6b5c52a081c66475 Mon Sep 17 00:00:00 2001
From: Soispha <soispha@vhack.eu>
Date: Tue, 4 Jul 2023 14:21:30 +0200
Subject: Fix(system/services/nix-sync): Add some required paths to unit

---
 system/services/nix-sync/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/system/services/nix-sync/default.nix b/system/services/nix-sync/default.nix
index e951119..07c621a 100644
--- a/system/services/nix-sync/default.nix
+++ b/system/services/nix-sync/default.nix
@@ -81,7 +81,8 @@
       # Security
       NoNewPrivileges = true;
       # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
-      ReadWritePaths = ["${repo.path}" "${esa repoCachePath}"];
+      ReadWritePaths = ["${esa repo.path}" "-${esa repoCachePath}"];
+      ReadOnlyPaths = ["/nix"];
       ProtectSystem = "strict";
       ProtectHome = true;
       PrivateTmp = true;
-- 
cgit 1.4.1