2 files changed, 13 insertions, 1 deletions
diff --git a/sys/default.nix b/sys/default.nix
index 228c126..3224c40 100644
--- a/sys/default.nix
+++ b/sys/default.nix
@@ -1,10 +1,11 @@
-{ lib, config, pkgs, modulesPath, ... }:
+{ lib, config, pkgs, ... }:
 with lib; {
   imports = [
     ./auth.nix
     ./boot.nix
     ./fs
     ./net.nix
+    ./nspawn.nix
     ./options.nix
     ./users.nix
   ];
diff --git a/sys/nspawn.nix b/sys/nspawn.nix
new file mode 100644
index 0000000..528223a
--- /dev/null
+++ b/sys/nspawn.nix
@@ -0,0 +1,11 @@
+{ lib, config, ... }:
+with lib; let
+  cfg = config.local.nspawn;
+in
+{
+  options.local.nspawn.dmz.enable = mkEnableOption "DMZ services in a container";
+
+  config.systemd.nspawn.dmz = mkIf cfg.dmz.enable {
+    execConfig.PrivateUsers = true;
+  };
+}