From b9179506b83c6c3c58a15bf8e379fb9a8bc8e819 Mon Sep 17 00:00:00 2001
From: Ahmed AbdelHalim <pm@a14m.me>
Date: Tue, 9 Sep 2025 23:42:40 +0200
Subject: Fix systemd service to work with wireguard

---
 deployment/wg-portal.service | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/deployment/wg-portal.service b/deployment/wg-portal.service
index 23d9dad..e68f04c 100644
--- a/deployment/wg-portal.service
+++ b/deployment/wg-portal.service
@@ -17,13 +17,15 @@ TimeoutStartSec=30
 TimeoutStopSec=30
 
 # Security hardening
-NoNewPrivileges=true
+# NoNewPrivileges=true can't work becasue it's needed for sudo wg commands
+NoNewPrivileges=false
 ProtectSystem=strict
 ProtectHome=true
 ReadWritePaths=/etc/wireguard
 PrivateTmp=true
 PrivateDevices=true
-ProtectKernelTunables=true
+# ProtectKernelTunables=true prevents the service from writing to /proc/sys/* paths, sudo wg quick up fails
+ProtectKernelTunables=false
 ProtectKernelModules=true
 ProtectControlGroups=true
 RestrictSUIDSGID=true
-- 
cgit v1.2.3