feat: write these as modules

remote/cache-service/flake.nix

@@ -38,6 +38,8 @@
     {
       packages.${system}.default = noisebell-cache;
 
+      nixosModules.default = import ./module.nix self;
+
       devShells.${system}.default = craneLib.devShell {
         packages = [ pkgs.rust-analyzer ];
       };

remote/cache-service/module.nix

@@ -0,0 +1,146 @@
+self:
+{ config, lib, ... }:
+
+let
+  cfg = config.services.noisebell-cache;
+  bin = "${self.packages.x86_64-linux.default}/bin/noisebell-cache";
+in
+{
+  options.services.noisebell-cache = {
+    enable = lib.mkEnableOption "noisebell cache service";
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      description = "Domain for the Caddy virtual host.";
+    };
+
+    piAddress = lib.mkOption {
+      type = lib.types.str;
+      description = "Address of the Pi (e.g. http://noisebell:80).";
+    };
+
+    piApiKeyFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to file containing API key for authenticating to Pi GET endpoints.";
+    };
+
+    inboundApiKeyFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to file containing API key for the cache's inbound webhook.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 3000;
+    };
+
+    statusPollIntervalSecs = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 60;
+    };
+
+    infoPollIntervalSecs = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 300;
+    };
+
+    offlineThreshold = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 3;
+    };
+
+    retryAttempts = lib.mkOption {
+      type = lib.types.ints.unsigned;
+      default = 3;
+    };
+
+    retryBaseDelaySecs = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 1;
+    };
+
+    httpTimeoutSecs = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 10;
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/noisebell-cache";
+    };
+
+    outboundWebhooks = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule {
+        options = {
+          url = lib.mkOption { type = lib.types.str; };
+          secretFile = lib.mkOption {
+            type = lib.types.nullOr lib.types.path;
+            default = null;
+          };
+        };
+      });
+      default = [];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.noisebell-cache = {
+      isSystemUser = true;
+      group = "noisebell-cache";
+    };
+    users.groups.noisebell-cache = {};
+
+    services.caddy.virtualHosts.${cfg.domain}.extraConfig = ''
+      reverse_proxy localhost:${toString cfg.port}
+    '';
+
+    systemd.services.noisebell-cache = let
+      webhookExports = lib.concatImapStringsSep "\n" (i: wh:
+        let idx = toString (i - 1); in
+        ''export NOISEBELL_CACHE_WEBHOOK_${idx}_URL="${wh.url}"'' +
+        lib.optionalString (wh.secretFile != null)
+          ''\nexport NOISEBELL_CACHE_WEBHOOK_${idx}_SECRET="$(cat ${wh.secretFile})"''
+      ) cfg.outboundWebhooks;
+    in {
+      description = "Noisebell cache service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      environment = {
+        NOISEBELL_CACHE_PORT = toString cfg.port;
+        NOISEBELL_CACHE_PI_ADDRESS = cfg.piAddress;
+        NOISEBELL_CACHE_DATA_DIR = cfg.dataDir;
+        NOISEBELL_CACHE_STATUS_POLL_INTERVAL_SECS = toString cfg.statusPollIntervalSecs;
+        NOISEBELL_CACHE_INFO_POLL_INTERVAL_SECS = toString cfg.infoPollIntervalSecs;
+        NOISEBELL_CACHE_OFFLINE_THRESHOLD = toString cfg.offlineThreshold;
+        NOISEBELL_CACHE_RETRY_ATTEMPTS = toString cfg.retryAttempts;
+        NOISEBELL_CACHE_RETRY_BASE_DELAY_SECS = toString cfg.retryBaseDelaySecs;
+        NOISEBELL_CACHE_HTTP_TIMEOUT_SECS = toString cfg.httpTimeoutSecs;
+        RUST_LOG = "info";
+      };
+      script = ''
+        export NOISEBELL_CACHE_INBOUND_API_KEY="$(cat ${cfg.inboundApiKeyFile})"
+        export NOISEBELL_CACHE_PI_API_KEY="$(cat ${cfg.piApiKeyFile})"
+        ${webhookExports}
+        exec ${bin}
+      '';
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+        RestartSec = 5;
+        User = "noisebell-cache";
+        Group = "noisebell-cache";
+        StateDirectory = "noisebell-cache";
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictSUIDSGID = true;
+        ReadWritePaths = [ cfg.dataDir ];
+      };
+    };
+  };
+}