add microbin to helix (create module)
This commit is contained in:
		
							parent
							
								
									eef4f59aa6
								
							
						
					
					
						commit
						f140ebbda3
					
				|  | @ -10,6 +10,7 @@ | |||
|     ../profiles/rss-bridge | ||||
|     ../profiles/mount-mossnet | ||||
|     ../profiles/freshrss | ||||
|     ../profiles/microbin | ||||
|   ]; | ||||
| 
 | ||||
|   # Capsul specific | ||||
|  |  | |||
							
								
								
									
										18
									
								
								hosts/profiles/microbin/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										18
									
								
								hosts/profiles/microbin/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,18 @@ | |||
| { config, lib, pkgs, ... }: | ||||
| { | ||||
|   services.microbin.enable = true; | ||||
|   services.microbin.hostname = "bin.sealight.xyz"; | ||||
|   services.microbin.port = 4949; | ||||
|   networking.firewall.allowedTCPPorts = [ 4949 ]; | ||||
|   services.nginx.virtualHosts."bin.sealight.xyz" = { | ||||
|     enableACME = true; | ||||
|     forceSSL = true; | ||||
| 
 | ||||
|     locations."/" = { | ||||
|       extraConfig = '' | ||||
|         proxy_pass http://localhost:4949/; | ||||
|         proxy_set_header X-Forwarded-Host $host; | ||||
|       ''; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
							
								
								
									
										85
									
								
								modules/nixos/microbin.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										85
									
								
								modules/nixos/microbin.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,85 @@ | |||
| { config, lib, pkgs, ... }: | ||||
| 
 | ||||
| with lib; | ||||
| 
 | ||||
| let | ||||
|   cfg = config.services.microbin; | ||||
|   configFile = "/etc/microbin/config"; | ||||
|   dataFolder = "/var/lib/microbin"; | ||||
| in | ||||
| { | ||||
|   options = { | ||||
| 
 | ||||
|     services.microbin = { | ||||
|       enable = mkEnableOption "A super tiny pasta"; | ||||
| 
 | ||||
|       user = mkOption { | ||||
|         type = types.str; | ||||
|         default = "microbin"; | ||||
|         description = "User account under which microbin runs."; | ||||
|       }; | ||||
| 
 | ||||
|       group = mkOption { | ||||
|         type = types.str; | ||||
|         default = "microbin"; | ||||
|         description = "Group account under which microbin runs."; | ||||
|       }; | ||||
| 
 | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   config = mkIf cfg.enable { | ||||
|     systemd.services.microbin = { | ||||
|       description = "Microbin A Super Tiny Pasta"; | ||||
|       after = [ "remote-fs.target" "network.target" ]; | ||||
|       wantedBy = [ "multi-user.target" ]; | ||||
|       serviceConfig = { | ||||
|         ExecStart = "${pkgs.microbin}/bin/microbin --port ${cfg.port} \\  | ||||
|         --public-path ${cfg.hostname} \\  | ||||
|         --editable \\  | ||||
|         --enable-burn-after \\  | ||||
|         --private \\  | ||||
|         --qr \\  | ||||
|         --title=sealight \\  | ||||
|         --highlightsyntax"; | ||||
|         WorkingDirectory = dataFolder; | ||||
|         TimeoutStopSec = " 20 "; | ||||
|         KillMode = " process "; | ||||
|         Restart = " on-failure "; | ||||
|         RestartSec = " 10 "; | ||||
|         User = cfg.user; | ||||
|         Group = cfg.group; | ||||
|         DevicePolicy = " closed "; | ||||
|         NoNewPrivileges = " yes "; | ||||
|         PrivateTmp = " yes "; | ||||
|         PrivateUsers = " yes "; | ||||
|         ProtectControlGroups = " yes "; | ||||
|         ProtectKernelModules = " yes "; | ||||
|         ProtectKernelTunables = " yes "; | ||||
|         RestrictAddressFamilies = " | ||||
|           AF_UNIX | ||||
|           AF_INET | ||||
|           AF_INET6 "; | ||||
|         RestrictNamespaces = " yes "; | ||||
|         RestrictRealtime = " yes "; | ||||
|         SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap"; | ||||
|         ReadWritePaths = dataFolder; | ||||
|         StateDirectory = baseNameOf dataFolder; | ||||
|       }; | ||||
|     }; | ||||
| 
 | ||||
|     users.users = optionalAttrs (cfg.user == "microbin") ({ | ||||
|       microbin = { | ||||
|         description = "microbin service user"; | ||||
|         name = cfg.user; | ||||
|         group = cfg.group; | ||||
|         isSystemUser = true; | ||||
|       }; | ||||
|     }); | ||||
| 
 | ||||
|     users.groups = optionalAttrs (cfg.group == "microbin") ({ | ||||
|       microbin = { }; | ||||
|     }); | ||||
|   }; | ||||
| } | ||||
| 
 | ||||
		Loading…
	
		Reference in a new issue