helm/modules/nixos/gpodder2go.nix

115 lines
2.9 KiB
Nix
Raw Normal View History

2024-08-19 21:29:25 -07:00
{ self, config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.gpodder2go;
in
{
options = {
services.gpodder = {
enable = mkEnableOption "A gpodder instance";
user = mkOption {
type = types.str;
default = "gpodder";
description = "User account under which gpodder runs.";
};
group = mkOption {
type = types.str;
default = "gpodder";
description = "Group account under which gpodder runs.";
};
hostname = mkOption {
type = types.str;
description = "Hostname of your gpodder service";
};
dataFolder = mkOption {
type = types.str;
default = "/var/lib/gpodder";
description = "State director";
};
VERIFIER_SECRET_KEY = mkOption {
type = types.str;
default = "satnheiycglsrcgaecrlufg";
description = "Verifer Secret";
};
};
};
config = mkIf cfg.enable {
systemd.services.gpodder = {
description = "gpodder2go A gpodder instance";
after = [ "remote-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${pkgs.gpodder2go}/bin/gpodder2go serve";
Environment = [
"VERIFIER_SECRET_KEY=${cfg.VERIFIER_SECRET_KEY}"
];
WorkingDirectory = dataFolder;
TimeoutStopSec = " 20 ";
KillMode = " process ";
RestartSec = " 10 ";
User = cfg.user;
Group = cfg.group;
DevicePolicy = " closed ";
NoNewPrivileges = " yes ";
PrivateTmp = " yes ";
PrivateUsers = " yes ";
ProtectControlGroups = " yes ";
ProtectKernelModules = " yes ";
ProtectKernelTunables = " yes ";
RestrictAddressFamilies = "
AF_UNIX
AF_INET
AF_INET6 ";
RestrictNamespaces = " yes ";
RestrictRealtime = " yes ";
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
ReadWritePaths = dataFolder;
StateDirectory = baseNameOf dataFolder;
};
};
users.users = optionalAttrs (cfg.user == "gpodder") ({
gpodder = {
description = "gpodder service user";
name = cfg.user;
group = cfg.group;
isSystemUser = true;
};
});
users.groups = optionalAttrs (cfg.group == "gpodder") ({
gpodder = { };
});
};
systemd.services.gpodder-install = {
description = "gpodder install service";
wantedBy = [ "multi-user.target" ];
before = [ "gpodder.service" ];
path = with pkgs; [ gpodder2go ];
serviceConfig = {
User = cfg.user;
Type = "oneshot";
} // commonServiceConfig;
script = ''
if [ ! -f "${cfg.dataFolder}/installed" ]; then
${pkgs.gpodder2go}/bin/gpodder2go init
touch "${cfg.dataFolder}/installed"
fi
'';
};
}