add microbin to helix (create module)

This commit is contained in:
Anish Lakhwara 2023-05-11 23:03:33 +10:00
parent eef4f59aa6
commit f140ebbda3
3 changed files with 104 additions and 0 deletions

View file

@ -10,6 +10,7 @@
../profiles/rss-bridge ../profiles/rss-bridge
../profiles/mount-mossnet ../profiles/mount-mossnet
../profiles/freshrss ../profiles/freshrss
../profiles/microbin
]; ];
# Capsul specific # Capsul specific

View file

@ -0,0 +1,18 @@
{ config, lib, pkgs, ... }:
{
services.microbin.enable = true;
services.microbin.hostname = "bin.sealight.xyz";
services.microbin.port = 4949;
networking.firewall.allowedTCPPorts = [ 4949 ];
services.nginx.virtualHosts."bin.sealight.xyz" = {
enableACME = true;
forceSSL = true;
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:4949/;
proxy_set_header X-Forwarded-Host $host;
'';
};
};
}

View file

@ -0,0 +1,85 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.microbin;
configFile = "/etc/microbin/config";
dataFolder = "/var/lib/microbin";
in
{
options = {
services.microbin = {
enable = mkEnableOption "A super tiny pasta";
user = mkOption {
type = types.str;
default = "microbin";
description = "User account under which microbin runs.";
};
group = mkOption {
type = types.str;
default = "microbin";
description = "Group account under which microbin runs.";
};
};
};
config = mkIf cfg.enable {
systemd.services.microbin = {
description = "Microbin A Super Tiny Pasta";
after = [ "remote-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${pkgs.microbin}/bin/microbin --port ${cfg.port} \\
--public-path ${cfg.hostname} \\
--editable \\
--enable-burn-after \\
--private \\
--qr \\
--title=sealight \\
--highlightsyntax";
WorkingDirectory = dataFolder;
TimeoutStopSec = " 20 ";
KillMode = " process ";
Restart = " on-failure ";
RestartSec = " 10 ";
User = cfg.user;
Group = cfg.group;
DevicePolicy = " closed ";
NoNewPrivileges = " yes ";
PrivateTmp = " yes ";
PrivateUsers = " yes ";
ProtectControlGroups = " yes ";
ProtectKernelModules = " yes ";
ProtectKernelTunables = " yes ";
RestrictAddressFamilies = "
AF_UNIX
AF_INET
AF_INET6 ";
RestrictNamespaces = " yes ";
RestrictRealtime = " yes ";
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
ReadWritePaths = dataFolder;
StateDirectory = baseNameOf dataFolder;
};
};
users.users = optionalAttrs (cfg.user == "microbin") ({
microbin = {
description = "microbin service user";
name = cfg.user;
group = cfg.group;
isSystemUser = true;
};
});
users.groups = optionalAttrs (cfg.group == "microbin") ({
microbin = { };
});
};
}