#include <tunables/global>

profile hassio-addons/obsidian_syncserver_ssl flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/nameservice>
  #include <abstractions/openssl>

  # Baseline profile for CouchDB in HAOS. CouchDB runs on the Erlang VM,
  # which needs broad file and network access plus the ability to drop
  # privileges to the couchdb user.
  file,
  network,

  capability chown,
  capability dac_override,
  capability fowner,
  capability setgid,
  capability setuid,

  # Certificates are supplied by the user through the read-only /ssl map.
  /ssl/** r,

  deny /proc/kcore rwklx,
  deny /proc/sysrq-trigger rwklx,
  deny /sys/firmware/** rwklx,
}