diff --git a/hosts/helix/default.nix b/hosts/helix/default.nix index 5eb1e10a..3bf9e7ae 100644 --- a/hosts/helix/default.nix +++ b/hosts/helix/default.nix @@ -10,6 +10,7 @@ ../profiles/rss-bridge ../profiles/mount-mossnet ../profiles/freshrss + ../profiles/microbin ]; # Capsul specific diff --git a/hosts/profiles/microbin/default.nix b/hosts/profiles/microbin/default.nix new file mode 100644 index 00000000..8fca359a --- /dev/null +++ b/hosts/profiles/microbin/default.nix @@ -0,0 +1,18 @@ +{ config, lib, pkgs, ... }: +{ + services.microbin.enable = true; + services.microbin.hostname = "bin.sealight.xyz"; + services.microbin.port = 4949; + networking.firewall.allowedTCPPorts = [ 4949 ]; + services.nginx.virtualHosts."bin.sealight.xyz" = { + enableACME = true; + forceSSL = true; + + locations."/" = { + extraConfig = '' + proxy_pass http://localhost:4949/; + proxy_set_header X-Forwarded-Host $host; + ''; + }; + }; +} diff --git a/modules/nixos/microbin.nix b/modules/nixos/microbin.nix new file mode 100644 index 00000000..4d2cb097 --- /dev/null +++ b/modules/nixos/microbin.nix @@ -0,0 +1,85 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.microbin; + configFile = "/etc/microbin/config"; + dataFolder = "/var/lib/microbin"; +in +{ + options = { + + services.microbin = { + enable = mkEnableOption "A super tiny pasta"; + + user = mkOption { + type = types.str; + default = "microbin"; + description = "User account under which microbin runs."; + }; + + group = mkOption { + type = types.str; + default = "microbin"; + description = "Group account under which microbin runs."; + }; + + }; + }; + + config = mkIf cfg.enable { + systemd.services.microbin = { + description = "Microbin A Super Tiny Pasta"; + after = [ "remote-fs.target" "network.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${pkgs.microbin}/bin/microbin --port ${cfg.port} \\ + --public-path ${cfg.hostname} \\ + --editable \\ + --enable-burn-after \\ + --private \\ + --qr \\ + --title=sealight \\ + --highlightsyntax"; + WorkingDirectory = dataFolder; + TimeoutStopSec = " 20 "; + KillMode = " process "; + Restart = " on-failure "; + RestartSec = " 10 "; + User = cfg.user; + Group = cfg.group; + DevicePolicy = " closed "; + NoNewPrivileges = " yes "; + PrivateTmp = " yes "; + PrivateUsers = " yes "; + ProtectControlGroups = " yes "; + ProtectKernelModules = " yes "; + ProtectKernelTunables = " yes "; + RestrictAddressFamilies = " + AF_UNIX + AF_INET + AF_INET6 "; + RestrictNamespaces = " yes "; + RestrictRealtime = " yes "; + SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap"; + ReadWritePaths = dataFolder; + StateDirectory = baseNameOf dataFolder; + }; + }; + + users.users = optionalAttrs (cfg.user == "microbin") ({ + microbin = { + description = "microbin service user"; + name = cfg.user; + group = cfg.group; + isSystemUser = true; + }; + }); + + users.groups = optionalAttrs (cfg.group == "microbin") ({ + microbin = { }; + }); + }; +} +