Sanbox ddns service and fix auth problems

nixos/modules/ddns.nix

@@ -17,7 +17,20 @@ with lib; let
     systemd.services = listToAttrs (forEach domains (domain:
       nameValuePair "ddns-${domain}"
         {
-          serviceConfig.Type = "oneshot";
+          serviceConfig = {
+            Type = "oneshot";
+            PrivateTmp = true;
+            PrivateDevices = true;
+            PrivateUsers = true;
+            PrivateMounts = true;
+            PrivateIPC = true;
+            ProtectHome = true;
+            ProtectSystem = "strict";
+            ProtectKernelTunables = true;
+            BindReadOnlyPaths = [ credentialsPath ];
+            NoNewPrivileges = true;
+            CapabilitBoundingSet = [ ];
+          };
           script = ''
             function url() {
               echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"

secrets/ddns-credentials.age

@@ -1,11 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 J6ROvw BhBy5hKm+udUmCgQOhVnFFaGSGOOKqxOkaZUcp7Wy3k
+-> ssh-ed25519 J6ROvw GVvNIMXLPbV2vCUusgXXhbX5NiFBHiDEKcsKfmoyzkU
-itvOOCUKNo0IseolH//6Uj1zEDt207HleT1YWnDogAg
+5DPaglRaORrOfzNkjUCSxGEUxxFb4+4LKU/AZlBvUa8
--> ssh-ed25519 Otklkw /5YCYZwTZ//JfGJzIIizcwhqem1P/ZTDdhJFfEjQQX4
+-> ssh-ed25519 Otklkw 6OI2jcEMolDqSXT/lDDn/Bmzl7TuSi3nzSjJPr1Fyno
-z7WS/uHDKGyuUP+ZKVVVc8b4bybsaQH6XrxOO3vOg1Q
+evOwwYz0VNf+CSlQBv9M/M+BgW2+VffXk3Oei6rJJzE
--> n\fdBI(-grease -PZuR<|s w,[Y J* h~
+-> 'v-grease X
-mwA80O5+Q8KqYJSYneiqKcP5tbDgA0GI9AuDOjbFPFcb8evizd0RJxHdw9lDtIf1
+ZsnRwQ1kbRM6a34
-EBddBaL+m0/JjzvGE+Y
+--- E7ofwcMOJacS72nThz3xl/kOvgy0698mvRiJNmIorAc
---- ybCpT9fTz498c//mW49ziO5Qcpl+hJGly/qm9lzZR4s
+rd{U]
-Žùœ7#„ä:EPÍb5Ç2«è@ÿŽKùU†¡»VMÒ¿UAP_¤…J
xà‚Ð0>–™3 á
+ćĂ:&liŃĽ|YĺwËó¨RµďR5gE‹ÚđüRŤ˝—ű§˙!ďlŽ6eµ(R™1ö<07>ŕčr’<72>
-°„¬-¦f™´’