jet/noisebell
jet/noisebell
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: expose configurations, add retry, make stable

Browse source
This commit is contained in:
Jet Pham 2026-03-09 17:11:10 -07:00
parent c6e726c430
commit 50ec63a474
No known key found for this signature in database
11 changed files with 494 additions and 221 deletions
Download patch file Download diff file Expand all files Collapse all files

102
pi/flake.nix
View file

@ -4,9 +4,13 @@
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
noisebell.url = "path:./pi-service";
agenix = {
url = "github:ryantm/agenix";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs = { self, nixpkgs, noisebell }:
outputs = { self, nixpkgs, noisebell, agenix }:
let
nixosModule = { config, lib, pkgs, ... }:
let
@ -17,13 +21,13 @@
enable = lib.mkEnableOption "noisebell GPIO door monitor";
gpioPin = lib.mkOption {
type = lib.types.int;
type = lib.types.ints.unsigned;
default = 17;
description = "GPIO pin number to monitor.";
};
debounceSecs = lib.mkOption {
type = lib.types.int;
type = lib.types.ints.positive;
default = 5;
description = "Debounce delay in seconds.";
};
@ -34,33 +38,104 @@
description = "HTTP port for the status endpoint.";
};
endpointUrl = lib.mkOption {
type = lib.types.str;
description = "URL to POST state changes to.";
endpointUrlFile = lib.mkOption {
type = lib.types.path;
description = "Path to a file containing the endpoint URL (e.g. an agenix secret).";
};
retryAttempts = lib.mkOption {
type = lib.types.ints.unsigned;
default = 3;
description = "Number of retries after a failed webhook POST.";
};
retryBaseDelaySecs = lib.mkOption {
type = lib.types.ints.positive;
default = 1;
description = "Base delay in seconds for exponential backoff between retries.";
};
httpTimeoutSecs = lib.mkOption {
type = lib.types.ints.positive;
default = 10;
description = "Timeout in seconds for outbound HTTP requests to the webhook endpoint.";
};
bindAddress = lib.mkOption {
type = lib.types.str;
default = "0.0.0.0";
description = "Address to bind the HTTP server to.";
};
activeLow = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Whether a low GPIO level means open. Set to false if your sensor wiring is inverted.";
};
restartDelaySecs = lib.mkOption {
type = lib.types.ints.positive;
default = 5;
description = "Seconds to wait before systemd restarts the service on failure.";
};
};
config = lib.mkIf cfg.enable {
systemd.services.noisebell = {
users.users.noisebell = {
isSystemUser = true;
group = "noisebell";
extraGroups = [ "gpio" ];
};
users.groups.noisebell = {};
users.groups.gpio = {};
services.udev.extraRules = ''
KERNEL=="gpiomem", GROUP="gpio", MODE="0660"
KERNEL=="gpiochip[0-9]*", GROUP="gpio", MODE="0660"
'';
systemd.services.noisebell = let
bin = "${noisebell.packages.aarch64-linux.default}/bin/noisebell";
in {
description = "Noisebell GPIO door monitor";
wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" ];
after = [ "network-online.target" "tailscaled.service" ];
wants = [ "network-online.target" ];
environment = {
NOISEBELL_GPIO_PIN = toString cfg.gpioPin;
NOISEBELL_DEBOUNCE_SECS = toString cfg.debounceSecs;
NOISEBELL_PORT = toString cfg.port;
NOISEBELL_ENDPOINT_URL = cfg.endpointUrl;
NOISEBELL_RETRY_ATTEMPTS = toString cfg.retryAttempts;
NOISEBELL_RETRY_BASE_DELAY_SECS = toString cfg.retryBaseDelaySecs;
NOISEBELL_HTTP_TIMEOUT_SECS = toString cfg.httpTimeoutSecs;
NOISEBELL_BIND_ADDRESS = cfg.bindAddress;
NOISEBELL_ACTIVE_LOW = if cfg.activeLow then "true" else "false";
RUST_LOG = "info";
};
script = ''
export NOISEBELL_ENDPOINT_URL="$(cat ${cfg.endpointUrlFile})"
exec ${bin}
'';
serviceConfig = {
ExecStart = "${noisebell.packages.aarch64-linux.default}/bin/noisebell";
Restart = "on-failure";
RestartSec = 5;
DynamicUser = true;
SupplementaryGroups = [ "gpio" ];
RestartSec = cfg.restartDelaySecs;
User = "noisebell";
Group = "noisebell";
AmbientCapabilities = lib.optionals (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
NoNewPrivileges = true;
ProtectSystem = "strict";
ProtectHome = true;
PrivateTmp = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
RestrictSUIDSGID = true;
MemoryDenyWriteExecute = true;
DevicePolicy = "closed";
DeviceAllow = [ "char-gpiomem rw" "char-gpiochip rw" ];
};
};
};
@ -72,6 +147,7 @@
nixosConfigurations.pi = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
modules = [
agenix.nixosModules.default
nixosModule
./configuration.nix
./hardware-configuration.nix