242 lines
10 KiB
Nix
242 lines
10 KiB
Nix
{
|
|
description = "NixOS configuration for noisebell remote services";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
agenix = {
|
|
url = "github:ryantm/agenix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
noisebell-cache.url = "path:./cache-service";
|
|
noisebell-discord.url = "path:./discord-bot";
|
|
noisebell-rss.url = "path:./rss-service";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, agenix, noisebell-cache, noisebell-discord, noisebell-rss }:
|
|
let
|
|
|
|
# ── Cache module ──────────────────────────────────────────────────
|
|
cacheModule = { config, lib, pkgs, ... }:
|
|
let cfg = config.services.noisebell-cache; in
|
|
{
|
|
options.services.noisebell-cache = {
|
|
enable = lib.mkEnableOption "noisebell cache service";
|
|
domain = lib.mkOption { type = lib.types.str; };
|
|
piAddress = lib.mkOption { type = lib.types.str; };
|
|
piApiKeyFile = lib.mkOption { type = lib.types.path; description = "Path to agenix secret for authenticating to Pi GET endpoints."; };
|
|
inboundApiKeyFile = lib.mkOption { type = lib.types.path; };
|
|
port = lib.mkOption { type = lib.types.port; default = 3000; };
|
|
statusPollIntervalSecs = lib.mkOption { type = lib.types.ints.positive; default = 60; };
|
|
infoPollIntervalSecs = lib.mkOption { type = lib.types.ints.positive; default = 300; };
|
|
offlineThreshold = lib.mkOption { type = lib.types.ints.positive; default = 3; };
|
|
retryAttempts = lib.mkOption { type = lib.types.ints.unsigned; default = 3; };
|
|
retryBaseDelaySecs = lib.mkOption { type = lib.types.ints.positive; default = 1; };
|
|
httpTimeoutSecs = lib.mkOption { type = lib.types.ints.positive; default = 10; };
|
|
dataDir = lib.mkOption { type = lib.types.str; default = "/var/lib/noisebell-cache"; };
|
|
outboundWebhooks = lib.mkOption {
|
|
type = lib.types.listOf (lib.types.submodule {
|
|
options = {
|
|
url = lib.mkOption { type = lib.types.str; };
|
|
secretFile = lib.mkOption { type = lib.types.nullOr lib.types.path; default = null; };
|
|
};
|
|
});
|
|
default = [];
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
users.users.noisebell-cache = { isSystemUser = true; group = "noisebell-cache"; };
|
|
users.groups.noisebell-cache = {};
|
|
|
|
services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
|
|
reverse_proxy localhost:${toString cfg.port}
|
|
'';
|
|
|
|
systemd.services.noisebell-cache = let
|
|
bin = "${noisebell-cache.packages.x86_64-linux.default}/bin/noisebell-cache";
|
|
webhookExports = lib.concatImapStringsSep "\n" (i: wh:
|
|
let idx = toString (i - 1); in
|
|
''export NOISEBELL_CACHE_WEBHOOK_${idx}_URL="${wh.url}"'' +
|
|
lib.optionalString (wh.secretFile != null)
|
|
''\nexport NOISEBELL_CACHE_WEBHOOK_${idx}_SECRET="$(cat ${wh.secretFile})"''
|
|
) cfg.outboundWebhooks;
|
|
in {
|
|
description = "Noisebell cache service";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
environment = {
|
|
NOISEBELL_CACHE_PORT = toString cfg.port;
|
|
NOISEBELL_CACHE_PI_ADDRESS = cfg.piAddress;
|
|
NOISEBELL_CACHE_DATA_DIR = cfg.dataDir;
|
|
NOISEBELL_CACHE_STATUS_POLL_INTERVAL_SECS = toString cfg.statusPollIntervalSecs;
|
|
NOISEBELL_CACHE_INFO_POLL_INTERVAL_SECS = toString cfg.infoPollIntervalSecs;
|
|
NOISEBELL_CACHE_OFFLINE_THRESHOLD = toString cfg.offlineThreshold;
|
|
NOISEBELL_CACHE_RETRY_ATTEMPTS = toString cfg.retryAttempts;
|
|
NOISEBELL_CACHE_RETRY_BASE_DELAY_SECS = toString cfg.retryBaseDelaySecs;
|
|
NOISEBELL_CACHE_HTTP_TIMEOUT_SECS = toString cfg.httpTimeoutSecs;
|
|
RUST_LOG = "info";
|
|
};
|
|
script = ''
|
|
export NOISEBELL_CACHE_INBOUND_API_KEY="$(cat ${cfg.inboundApiKeyFile})"
|
|
export NOISEBELL_CACHE_PI_API_KEY="$(cat ${cfg.piApiKeyFile})"
|
|
${webhookExports}
|
|
exec ${bin}
|
|
'';
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
Restart = "on-failure";
|
|
RestartSec = 5;
|
|
User = "noisebell-cache";
|
|
Group = "noisebell-cache";
|
|
StateDirectory = "noisebell-cache";
|
|
NoNewPrivileges = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
PrivateTmp = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelModules = true;
|
|
ProtectControlGroups = true;
|
|
RestrictSUIDSGID = true;
|
|
ReadWritePaths = [ cfg.dataDir ];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
# ── Discord module ────────────────────────────────────────────────
|
|
discordModule = { config, lib, pkgs, ... }:
|
|
let cfg = config.services.noisebell-discord; in
|
|
{
|
|
options.services.noisebell-discord = {
|
|
enable = lib.mkEnableOption "noisebell Discord bot";
|
|
domain = lib.mkOption { type = lib.types.str; };
|
|
port = lib.mkOption { type = lib.types.port; default = 3001; };
|
|
discordTokenFile = lib.mkOption { type = lib.types.path; };
|
|
channelId = lib.mkOption { type = lib.types.str; };
|
|
webhookSecretFile = lib.mkOption { type = lib.types.path; };
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
users.users.noisebell-discord = { isSystemUser = true; group = "noisebell-discord"; };
|
|
users.groups.noisebell-discord = {};
|
|
|
|
services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
|
|
reverse_proxy localhost:${toString cfg.port}
|
|
'';
|
|
|
|
systemd.services.noisebell-discord = let
|
|
bin = "${noisebell-discord.packages.x86_64-linux.default}/bin/noisebell-discord";
|
|
in {
|
|
description = "Noisebell Discord bot";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
environment = {
|
|
NOISEBELL_DISCORD_PORT = toString cfg.port;
|
|
NOISEBELL_DISCORD_CHANNEL_ID = cfg.channelId;
|
|
RUST_LOG = "info";
|
|
};
|
|
script = ''
|
|
export NOISEBELL_DISCORD_TOKEN="$(cat ${cfg.discordTokenFile})"
|
|
export NOISEBELL_DISCORD_WEBHOOK_SECRET="$(cat ${cfg.webhookSecretFile})"
|
|
exec ${bin}
|
|
'';
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
Restart = "on-failure";
|
|
RestartSec = 5;
|
|
User = "noisebell-discord";
|
|
Group = "noisebell-discord";
|
|
NoNewPrivileges = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
PrivateTmp = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelModules = true;
|
|
ProtectControlGroups = true;
|
|
RestrictSUIDSGID = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
# ── RSS module ────────────────────────────────────────────────────
|
|
rssModule = { config, lib, pkgs, ... }:
|
|
let cfg = config.services.noisebell-rss; in
|
|
{
|
|
options.services.noisebell-rss = {
|
|
enable = lib.mkEnableOption "noisebell RSS/Atom feed";
|
|
domain = lib.mkOption { type = lib.types.str; };
|
|
port = lib.mkOption { type = lib.types.port; default = 3002; };
|
|
webhookSecretFile = lib.mkOption { type = lib.types.path; };
|
|
dataDir = lib.mkOption { type = lib.types.str; default = "/var/lib/noisebell-rss"; };
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
users.users.noisebell-rss = { isSystemUser = true; group = "noisebell-rss"; };
|
|
users.groups.noisebell-rss = {};
|
|
|
|
services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
|
|
reverse_proxy localhost:${toString cfg.port}
|
|
'';
|
|
|
|
systemd.services.noisebell-rss = let
|
|
bin = "${noisebell-rss.packages.x86_64-linux.default}/bin/noisebell-rss";
|
|
in {
|
|
description = "Noisebell RSS/Atom feed";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
environment = {
|
|
NOISEBELL_RSS_PORT = toString cfg.port;
|
|
NOISEBELL_RSS_DATA_DIR = cfg.dataDir;
|
|
NOISEBELL_RSS_SITE_URL = "https://${cfg.domain}";
|
|
RUST_LOG = "info";
|
|
};
|
|
script = ''
|
|
export NOISEBELL_RSS_WEBHOOK_SECRET="$(cat ${cfg.webhookSecretFile})"
|
|
exec ${bin}
|
|
'';
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
Restart = "on-failure";
|
|
RestartSec = 5;
|
|
User = "noisebell-rss";
|
|
Group = "noisebell-rss";
|
|
StateDirectory = "noisebell-rss";
|
|
NoNewPrivileges = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
PrivateTmp = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelModules = true;
|
|
ProtectControlGroups = true;
|
|
RestrictSUIDSGID = true;
|
|
ReadWritePaths = [ cfg.dataDir ];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
in
|
|
{
|
|
nixosModules = {
|
|
cache = cacheModule;
|
|
discord = discordModule;
|
|
rss = rssModule;
|
|
};
|
|
|
|
nixosConfigurations.remote = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
cacheModule
|
|
discordModule
|
|
rssModule
|
|
./configuration.nix
|
|
./hardware-configuration.nix
|
|
];
|
|
};
|
|
};
|
|
}
|