nixosModule.nix - travelynx2fedi

1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
37 
38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 
49 
50 
51 
52 
53 
54 
55 
56 
57 
58 
59 
60 
61 
62 
63 
64 
65 
66 
67 
68 
69 
70 
71 
72 
73 
74 
75 
76 
77 
78 
79 
80 
81 
82 
83 
84 
85 
86 
87 
88 
89 
90 
91 
92 
93 
94 
95 
96 
97 
98 
99 
100 
101 
102 
103 
104 
105 
106 
107 
108 
109 
110 
111 
112 
113 
114 
115 
116 
117 
118 
119 
120 
121 
122 
123 
124 
125 
126 
{ options, config, pkgs, lib, ... }:

with lib;

let
  cfg            = config.services.travelynx2fedi;
  settingsFormat = pkgs.formats.ini {};
  configFile     = settingsFormat.generate "config.ini" cfg.config;

in {

  options = {
    services.travelynx2fedi = with lib; {
      enable = mkEnableOption "travelynx2fedi - post travelynx checkins to the fediverse";

      nginx = {
        enable     = mkEnableOption "";
        enableACME = mkEnableOption "";

        domain = mkOption {
          type = types.str;
        };

        path = mkOption {
          type    = types.str;
          default = "= /travelynx2fedi";
        };
      };

      package = mkOption {
        type    = types.package;
        default = pkgs.travelynx2fedi;
      };

      port = mkOption {
        type     = types.int;
        default  = 8321;
      };

      config = mkOption {
        type    = settingsFormat.type;
        default = {};
        example = {};
      };

      environmentFiles = mkOption {
        type = types.listOf types.path;
        default = [];
        example = [ "/run/keys/travelynx2fedi.env" ];
        description = lib.mdDoc ''
          File to load as environment file. Environment variables from this file
          will be interpolated into the config file using envsubst.
          This is useful to avoid putting secrets into the nix store.
        '';
      };

    };
  };


  config = lib.mkIf cfg.enable {

    services.nginx = lib.mkIf cfg.nginx.enable {
      virtualHosts."${cfg.nginx.domain}" = {
        enableACME = lib.mkIf cfg.nginx.enableACME true;
        forceSSL   = lib.mkIf cfg.nginx.enableACME true;
        locations."${cfg.nginx.path}".proxyPass = "http://[::1]:${builtins.toString cfg.port}";
      };
    };

    systemd.services.travelynx2fedi = {
      after           = [ "network-online.target" ];
      wantedBy        = [ "multi-user.target" ];

      environment = {
        TRAVELYNX2FEDI_PORT         = builtins.toString cfg.port;
        TRAVELYNX2FEDI_CONFIG_PATH  = (
          if cfg.environmentFiles == []
          then configFile
          else "/var/run/travelynx2fedi/config.ini"
        );
      };

      serviceConfig = {
        DynamicUser = true;

        Type = "exec";

        RuntimeDirectory   = "travelynx2fedi";
        StateDirectory     = "travelynx2fedi";
        StateDirectoryMode = "750";

        EnvironmentFile = cfg.environmentFiles;

        
        Restart    = "always";
        RestartSec = 3;

        ExecStartPre = lib.optional (cfg.environmentFiles != []) (pkgs.writeShellScript "travelynx2fedi-preStart" ''
          umask 077
          ${pkgs.envsubst}/bin/envsubst -i "${configFile}" > /var/run/travelynx2fedi/config.ini
        '');

        ExecStart = "${cfg.package}/bin/travelynx2fedi";

        NoNewPrivileges = true;
        PrivateTmp      = true;
        PrivateDevices  = false;

        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
        RestrictNamespaces      = true;
        RestrictRealtime        = true;
      
        ProtectSystem         = "full";
        ProtectControlGroups  = true;
        ProtectKernelModules  = true;
        ProtectKernelTunables = true;

        DevicePolicy     = "closed";
        LockPersonality  = true;
      };
    };

  };

}