121 lines
		
	
	
		
			3.1 KiB
		
	
	
	
		
			Nix
		
	
	
	
	
	
			
		
		
	
	
			121 lines
		
	
	
		
			3.1 KiB
		
	
	
	
		
			Nix
		
	
	
	
	
	
| { self, config, lib, pkgs, ... }:
 | |
| 
 | |
| with lib;
 | |
| 
 | |
| let
 | |
|   cfg = config.services.gpodder;
 | |
| in
 | |
| {
 | |
|   options = {
 | |
| 
 | |
|     services.gpodder = {
 | |
|       enable = mkEnableOption "A gpodder instance";
 | |
| 
 | |
|       user = mkOption {
 | |
|         type = types.str;
 | |
|         default = "gpodder";
 | |
|         description = "User account under which gpodder runs.";
 | |
|       };
 | |
| 
 | |
|       group = mkOption {
 | |
|         type = types.str;
 | |
|         default = "gpodder";
 | |
|         description = "Group account under which gpodder runs.";
 | |
|       };
 | |
| 
 | |
|       hostname = mkOption {
 | |
|         type = types.str;
 | |
|         description = "Hostname of your gpodder service";
 | |
|       };
 | |
| 
 | |
|       dataFolder = mkOption {
 | |
|         type = types.str;
 | |
|         default = "/var/lib/gpodder";
 | |
|         description = "State director";
 | |
|       };
 | |
| 
 | |
|       VERIFIER_SECRET_KEY = mkOption {
 | |
|         type = types.str;
 | |
|         default = "satnheiycglsrcgaecrlufg";
 | |
|         description = "Verifer Secret";
 | |
|       };
 | |
| 
 | |
|     };
 | |
|   };
 | |
| 
 | |
|   config = mkIf cfg.enable {
 | |
|     systemd.services.gpodder = {
 | |
|       description = "gpodder2go A gpodder instance";
 | |
|       after = [ "remote-fs.target" "network.target" ];
 | |
|       wantedBy = [ "multi-user.target" ];
 | |
|       serviceConfig = {
 | |
|         ExecStart = "${pkgs.gpodder2go}/bin/gpodder2go serve";
 | |
|         Environment = [
 | |
|           "VERIFIER_SECRET_KEY=${cfg.VERIFIER_SECRET_KEY}"
 | |
|         ];
 | |
|         WorkingDirectory = cfg.dataFolder;
 | |
|         TimeoutStopSec = " 20 ";
 | |
|         KillMode = " process ";
 | |
|         RestartSec = " 10 ";
 | |
|         User = cfg.user;
 | |
|         Group = cfg.group;
 | |
|         DevicePolicy = " closed ";
 | |
|         NoNewPrivileges = " yes ";
 | |
|         PrivateTmp = " yes ";
 | |
|         PrivateUsers = " yes ";
 | |
|         ProtectControlGroups = " yes ";
 | |
|         ProtectKernelModules = " yes ";
 | |
|         ProtectKernelTunables = " yes ";
 | |
|         RestrictAddressFamilies = "
 | |
|           AF_UNIX
 | |
|           AF_INET
 | |
|           AF_INET6 ";
 | |
|         RestrictNamespaces = " yes ";
 | |
|         RestrictRealtime = " yes ";
 | |
|         SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
 | |
|         ReadWritePaths = cfg.dataFolder;
 | |
|         StateDirectory = baseNameOf cfg.dataFolder;
 | |
|       };
 | |
|     };
 | |
| 
 | |
|     users.users = optionalAttrs (cfg.user == "gpodder") ({
 | |
|       gpodder = {
 | |
|         description = "gpodder service user";
 | |
|         name = cfg.user;
 | |
|         group = cfg.group;
 | |
|         isSystemUser = true;
 | |
|       };
 | |
|     });
 | |
| 
 | |
|     users.groups = optionalAttrs (cfg.group == "gpodder") ({
 | |
|       gpodder = { };
 | |
|     });
 | |
| 
 | |
|     # systemd.services.gpodder-install = {
 | |
|     #   description = "gpodder install service";
 | |
|     #   wantedBy = [ "multi-user.target" ];
 | |
|     #   before = [ "gpodder.service" ];
 | |
|     #   path = with pkgs; [ gpodder2go ];
 | |
| 
 | |
|     #   serviceConfig = {
 | |
|     #     User = cfg.user;
 | |
|     #     Type = "oneshot";
 | |
|     #     CacheDirectory = "gpodder";
 | |
|     #     # Stores sessions.
 | |
|     #     CacheDirectoryMode = "700";
 | |
|     #     ConfigurationDirectory = "gpodder";
 | |
|     #     LogsDirectory = "gpodder";
 | |
|     #     StateDirectory = "gpodder";
 | |
|     #   };
 | |
| 
 | |
|     #   script = ''
 | |
|     #   if [ ! -f "${cfg.dataFolder}/installed" ]; then
 | |
|     #     ${pkgs.gpodder2go}/bin/gpodder2go init
 | |
|     #     touch "${cfg.dataFolder}/installed"
 | |
|     #   fi
 | |
|     # '';
 | |
|     # };
 | |
|   };
 | |
| }
 | |
| 
 |