79 lines
2 KiB
Nix
79 lines
2 KiB
Nix
{
|
|
config,
|
|
inputs,
|
|
lib,
|
|
namespace,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
inherit (lib) mkIf;
|
|
inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort;
|
|
inherit (config.users) users groups;
|
|
inherit (config.sops) secrets;
|
|
inherit (config.networking) hostName;
|
|
|
|
networkCfg = getAttrByNamespace config "${namespace}.services.networking";
|
|
|
|
isEnabled = hostHasService networkCfg.network-services hostName "paste";
|
|
port = resolveServicePort networkCfg.network-services "paste" 5100;
|
|
in {
|
|
config = mkIf isEnabled {
|
|
systemd.services.rustypaste = {
|
|
description = "rustypaste";
|
|
|
|
wantedBy = ["multi-user.target"];
|
|
|
|
environment = {
|
|
AUTH_TOKENS_FILE = secrets."rustypaste/auth".path;
|
|
DELETE_TOKENS_FILE = secrets."rustypaste/delete".path;
|
|
CONFIG = "/etc/rustypaste/rustypaste.toml";
|
|
};
|
|
|
|
serviceConfig = {
|
|
User = users.rustypaste.name;
|
|
|
|
WorkingDirectory = "/var/lib/rustypaste";
|
|
StateDirectory = "rustypaste";
|
|
|
|
ExecStart = "${pkgs.rustypaste}/bin/rustypaste";
|
|
Restart = "always";
|
|
RestartSec = 30;
|
|
};
|
|
};
|
|
|
|
users = {
|
|
users.rustypaste = {
|
|
isSystemUser = true;
|
|
group = "rustypaste";
|
|
};
|
|
|
|
groups.rustypaste = {};
|
|
};
|
|
|
|
environment.etc."rustypaste/rustypaste.toml" = {
|
|
source = inputs.dotfiles + "/.config/rustypaste/server.toml";
|
|
mode = "0755";
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/rustypaste 2750 ${users.rustypaste.name} ${users.rustypaste.group} -"
|
|
];
|
|
|
|
sops.secrets = {
|
|
"rustypaste/auth" = {
|
|
owner = users.rustypaste.name;
|
|
group = groups.rustypaste.name;
|
|
mode = "0440";
|
|
};
|
|
"rustypaste/delete" = {
|
|
owner = users.rustypaste.name;
|
|
group = groups.rustypaste.name;
|
|
mode = "0440";
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [port];
|
|
|
|
${namespace}.services.storage.impermanence.folders = ["/var/lib/rustypaste"];
|
|
};
|
|
}
|