1 files changed, 11 insertions, 0 deletions
diff --git a/sys/nspawn.nix b/sys/nspawn.nix
new file mode 100644
index 0000000..528223a
--- /dev/null
+++ b/sys/nspawn.nix
@@ -0,0 +1,11 @@
+{ lib, config, ... }:
+with lib; let
+  cfg = config.local.nspawn;
+in
+{
+  options.local.nspawn.dmz.enable = mkEnableOption "DMZ services in a container";
+
+  config.systemd.nspawn.dmz = mkIf cfg.dmz.enable {
+    execConfig.PrivateUsers = true;
+  };
+}