pubcached/flake.nix

91 lines
3.0 KiB
Nix

{
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
};
outputs = { self, nixpkgs, ... }@inputs: let
forAllSystems = nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed;
in {
nixosModule = { pkgs, config, lib, ... }: let
cfg = config.papatutuwawa.pubcached;
in {
options.papatutuwawa.pubcached = {
enable = lib.mkEnableOption "Enable pubcached";
serverUrl = lib.mkOption {
description = "The URL to which archives should be redirected";
};
host = lib.mkOption {
description = "The host to bind to";
default = "127.0.0.1";
};
port = lib.mkOption {
description = "The port to bind to";
default = 8000;
};
};
config = lib.mkIf cfg.enable {
systemd.services.pubcached = let
settingsFormat = pkgs.formats.toml {};
configRaw = {
"db_path" = "/var/lib/pubcached/db.sqlite";
"package_path" = "/var/lib/pubcached/packages/";
"server_url" = cfg.serverUrl;
"host" = cfg.host;
"port" = cfg.port;
};
in {
description = "pubcached Service";
wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
serviceConfig = {
DynamicUser = true;
WorkingDirectory = "%S/pubcached";
StateDirectory = "pubcached";
StateDirectoryMode = "0700";
UMask = "0007";
ConfigurationDirectory = "pubcached";
ExecStart = "${pkgs.pubcached}/bin/pubcached -c ${settingsFormat.generate "config.toml" configRaw}";
Restart = "on-failure";
RestartSec = 15;
CapabilityBoundingSet = "";
# Security
NoNewPrivileges = true;
# Sandboxing
ProtectSystem = "strict";
ProtectHome = true;
PrivateTmp = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
PrivateMounts = true;
# System Call Filtering
SystemCallArchitectures = "native";
SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
};
};
};
};
packages = forAllSystems (system: let
pkgs = import nixpkgs { inherit system; };
in {
pubcached = pkgs.callPackage ./pkgs/pubcached.nix {};
});
};
}