add microbin to helix (create module)

hosts/helix/default.nix

@@ -10,6 +10,7 @@
     ../profiles/rss-bridge
     ../profiles/mount-mossnet
     ../profiles/freshrss
+    ../profiles/microbin
   ];
 
   # Capsul specific

hosts/profiles/microbin/default.nix

@@ -0,0 +1,18 @@
+{ config, lib, pkgs, ... }:
+{
+  services.microbin.enable = true;
+  services.microbin.hostname = "bin.sealight.xyz";
+  services.microbin.port = 4949;
+  networking.firewall.allowedTCPPorts = [ 4949 ];
+  services.nginx.virtualHosts."bin.sealight.xyz" = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://localhost:4949/;
+        proxy_set_header X-Forwarded-Host $host;
+      '';
+    };
+  };
+}

modules/nixos/microbin.nix

@@ -0,0 +1,85 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.microbin;
+  configFile = "/etc/microbin/config";
+  dataFolder = "/var/lib/microbin";
+in
+{
+  options = {
+
+    services.microbin = {
+      enable = mkEnableOption "A super tiny pasta";
+
+      user = mkOption {
+        type = types.str;
+        default = "microbin";
+        description = "User account under which microbin runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "microbin";
+        description = "Group account under which microbin runs.";
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.microbin = {
+      description = "Microbin A Super Tiny Pasta";
+      after = [ "remote-fs.target" "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.microbin}/bin/microbin --port ${cfg.port} \\ 
+        --public-path ${cfg.hostname} \\ 
+        --editable \\ 
+        --enable-burn-after \\ 
+        --private \\ 
+        --qr \\ 
+        --title=sealight \\ 
+        --highlightsyntax";
+        WorkingDirectory = dataFolder;
+        TimeoutStopSec = " 20 ";
+        KillMode = " process ";
+        Restart = " on-failure ";
+        RestartSec = " 10 ";
+        User = cfg.user;
+        Group = cfg.group;
+        DevicePolicy = " closed ";
+        NoNewPrivileges = " yes ";
+        PrivateTmp = " yes ";
+        PrivateUsers = " yes ";
+        ProtectControlGroups = " yes ";
+        ProtectKernelModules = " yes ";
+        ProtectKernelTunables = " yes ";
+        RestrictAddressFamilies = "
+          AF_UNIX
+          AF_INET
+          AF_INET6 ";
+        RestrictNamespaces = " yes ";
+        RestrictRealtime = " yes ";
+        SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
+        ReadWritePaths = dataFolder;
+        StateDirectory = baseNameOf dataFolder;
+      };
+    };
+
+    users.users = optionalAttrs (cfg.user == "microbin") ({
+      microbin = {
+        description = "microbin service user";
+        name = cfg.user;
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    });
+
+    users.groups = optionalAttrs (cfg.group == "microbin") ({
+      microbin = { };
+    });
+  };
+}
+