This is an attempt at a declarative secure-by-default weechat, as described in NixOS/nixpkgs#85080.
It depends on weechat 2.9 and should be workable in any distro. The configure
directive ultimately is passed as a string to weechat-headless's --run-command
flag.
This service:
- Runs as a DynamicUser=
- Has a safe (maybe) allowlist of commands that are allowed via the relay
- Only has write access to a private /tmp, and /var/log/weechat-headless
- Config (e.g. autojoin) via weechat is not supported and instead can only be passed via argv,
--run-command
. - Logs to stdout, and thus appears in journalctl.