helm/modules/nixos/microbin.nix

86 lines
2.2 KiB
Nix
Raw Normal View History

2023-05-11 06:03:33 -07:00
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.microbin;
configFile = "/etc/microbin/config";
dataFolder = "/var/lib/microbin";
in
{
options = {
services.microbin = {
enable = mkEnableOption "A super tiny pasta";
user = mkOption {
type = types.str;
default = "microbin";
description = "User account under which microbin runs.";
};
group = mkOption {
type = types.str;
default = "microbin";
description = "Group account under which microbin runs.";
};
};
};
config = mkIf cfg.enable {
systemd.services.microbin = {
description = "Microbin A Super Tiny Pasta";
after = [ "remote-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${pkgs.microbin}/bin/microbin --port ${cfg.port} \\
--public-path ${cfg.hostname} \\
--editable \\
--enable-burn-after \\
--private \\
--qr \\
--title=sealight \\
--highlightsyntax";
WorkingDirectory = dataFolder;
TimeoutStopSec = " 20 ";
KillMode = " process ";
Restart = " on-failure ";
RestartSec = " 10 ";
User = cfg.user;
Group = cfg.group;
DevicePolicy = " closed ";
NoNewPrivileges = " yes ";
PrivateTmp = " yes ";
PrivateUsers = " yes ";
ProtectControlGroups = " yes ";
ProtectKernelModules = " yes ";
ProtectKernelTunables = " yes ";
RestrictAddressFamilies = "
AF_UNIX
AF_INET
AF_INET6 ";
RestrictNamespaces = " yes ";
RestrictRealtime = " yes ";
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
ReadWritePaths = dataFolder;
StateDirectory = baseNameOf dataFolder;
};
};
users.users = optionalAttrs (cfg.user == "microbin") ({
microbin = {
description = "microbin service user";
name = cfg.user;
group = cfg.group;
isSystemUser = true;
};
});
users.groups = optionalAttrs (cfg.group == "microbin") ({
microbin = { };
});
};
}