101 lines
2.5 KiB
Nix
101 lines
2.5 KiB
Nix
self: {
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
with lib; {
|
|
options.services.regalade = {
|
|
enable = mkEnableOption "regalade, a recipe manager";
|
|
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = self.packages.${config.nixpkgs.system}.server;
|
|
};
|
|
|
|
apiPort = mkOption {
|
|
type = types.port;
|
|
default = 8085;
|
|
};
|
|
|
|
user = mkOption {
|
|
type = types.str;
|
|
default = "regalade";
|
|
};
|
|
|
|
environmentFile = mkOption {
|
|
type = types.nullOr types.path;
|
|
default = null;
|
|
};
|
|
|
|
frontend = {
|
|
enable = mkEnableOption "the frontend for regalade";
|
|
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = self.packages.${config.nixpkgs.system}.frontend;
|
|
};
|
|
};
|
|
};
|
|
|
|
config = let
|
|
cfg = config.services.regalade;
|
|
in
|
|
mkIf cfg.enable {
|
|
systemd.services.regalade = {
|
|
description = "regalade";
|
|
after = ["network.target" "postgresql.service"];
|
|
wantedBy = ["multi-user.target"];
|
|
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = cfg.user;
|
|
ExecStart = "${cfg.package}/bin/regalade";
|
|
EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
|
|
# Security
|
|
NoNewPrivileges = true;
|
|
# Sandboxing
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
PrivateTmp = true;
|
|
PrivateDevices = true;
|
|
PrivateUsers = true;
|
|
ProtectHostname = true;
|
|
ProtectClock = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectControlGroups = true;
|
|
RestrictAddressFamilies = ["AF_UNIX AF_INET AF_INET6"];
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
PrivateMounts = true;
|
|
};
|
|
|
|
environment = {
|
|
REGALADE_DATABASE_URL = "postgres://${cfg.user}/regalade?host=/var/run/postgresql";
|
|
};
|
|
};
|
|
|
|
services.postgresql = {
|
|
ensureUsers = [
|
|
{
|
|
name = cfg.user;
|
|
ensurePermissions = {"DATABASE \"regalade\"" = "ALL PRIVILEGES";};
|
|
}
|
|
];
|
|
ensureDatabases = ["regalade"];
|
|
};
|
|
|
|
users = mkIf (cfg.user == "regalade") {
|
|
users.regalade = {
|
|
description = "Regalade API server";
|
|
group = "regalade";
|
|
isSystemUser = true;
|
|
};
|
|
groups.regalade = {};
|
|
};
|
|
};
|
|
}
|