blob: d98446c30b33e9c7f9fef99054ebe2bd46300aef (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
{
config,
lib,
pkgs,
...
}:
let
inherit (lib) types;
cfg = config.services.docling-serve;
in
{
options = {
services.docling-serve = {
enable = lib.mkEnableOption "Docling Serve server";
package = lib.mkPackageOption pkgs "docling-serve" { };
stateDir = lib.mkOption {
type = types.path;
default = "/var/lib/docling-serve";
example = "/home/foo";
description = "State directory of Docling Serve.";
};
host = lib.mkOption {
type = types.str;
default = "127.0.0.1";
example = "0.0.0.0";
description = ''
The host address which the Docling Serve server HTTP interface listens to.
'';
};
port = lib.mkOption {
type = types.port;
default = 5001;
example = 11111;
description = ''
Which port the Docling Serve server listens to.
'';
};
environment = lib.mkOption {
type = types.attrsOf types.str;
default = {
DOCLING_SERVE_ENABLE_UI = "False";
};
example = ''
{
DOCLING_SERVE_ENABLE_UI = "True";
}
'';
description = ''
Extra environment variables for Docling Serve.
For more details see <https://github.com/docling-project/docling-serve/blob/main/docs/configuration.md>
'';
};
environmentFile = lib.mkOption {
description = ''
Environment file to be passed to the systemd service.
Useful for passing secrets to the service to prevent them from being
world-readable in the Nix store.
'';
type = lib.types.nullOr lib.types.path;
default = null;
example = "/var/lib/secrets/doclingServeSecrets";
};
openFirewall = lib.mkOption {
type = types.bool;
default = false;
description = ''
Whether to open the firewall for Docling Serve.
This adds `services.Docling Serve.port` to `networking.firewall.allowedTCPPorts`.
'';
};
};
};
config = lib.mkIf cfg.enable {
systemd.services.docling-serve = {
description = "Running Docling as an API service";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
environment = {
HF_HOME = ".";
EASYOCR_MODULE_PATH = ".";
MPLCONFIGDIR = ".";
}
// cfg.environment;
serviceConfig = {
ExecStart = "${lib.getExe cfg.package} run --host \"${cfg.host}\" --port ${toString cfg.port}";
EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
WorkingDirectory = cfg.stateDir;
StateDirectory = "docling-serve";
RuntimeDirectory = "docling-serve";
RuntimeDirectoryMode = "0755";
PrivateTmp = true;
DynamicUser = true;
DevicePolicy = "closed";
LockPersonality = true;
PrivateUsers = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectControlGroups = true;
RestrictNamespaces = true;
RestrictRealtime = true;
SystemCallArchitectures = "native";
UMask = "0077";
CapabilityBoundingSet = "";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
ProtectClock = true;
ProtectProc = "invisible";
};
};
networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.port ]; };
};
meta.maintainers = [ ];
}
|
