blob: bea84531014d2a479513ea1f2ca11a0e4157bf85 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.tap;
in
{
options.services.tap = {
enable = lib.mkEnableOption "Tap, ATProtocol firehose sync utility";
package = lib.mkPackageOption pkgs "tap" { };
environmentFiles = lib.mkOption {
type = lib.types.listOf lib.types.path;
default = [ ];
description = ''
Files to load environment variables from. Use for secrets such as
{env}`TAP_ADMIN_PASSWORD` that should not be readable in the Nix store.
'';
};
settings = lib.mkOption {
default = { };
description = ''
Configuration for Tap as environment variables. See the
[README](https://github.com/bluesky-social/indigo/blob/main/cmd/tap/README.md)
for all available options.
Secrets such as {option}`settings.TAP_ADMIN_PASSWORD` should be set via
{option}`environmentFiles` rather than here, as values set here will
be readable in the Nix store.
'';
type = lib.types.submodule {
freeformType = lib.types.attrsOf (
lib.types.nullOr (
lib.types.oneOf [
lib.types.bool
lib.types.int
lib.types.float
lib.types.str
]
)
);
options = {
TAP_BIND = lib.mkOption {
type = lib.types.str;
default = "127.0.0.1:2480";
description = "Address and port the HTTP server will listen on.";
};
TAP_DATABASE_URL = lib.mkOption {
type = lib.types.str;
default = "sqlite:///var/lib/tap/tap.db";
description = ''
Database connection string. Accepts SQLite (`sqlite://path`) or
PostgreSQL (`postgres://...`) connection strings.
'';
};
};
};
};
};
config = lib.mkIf cfg.enable {
systemd.services.tap = {
description = "Tap - ATProtocol firehose sync utility";
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
User = "tap";
DynamicUser = true;
ExecStart = "${lib.getExe cfg.package} run";
Environment = lib.mapAttrsToList (
k: v: "${k}=${if lib.isBool v then lib.boolToString v else toString v}"
) (lib.filterAttrs (_: v: v != null) cfg.settings);
EnvironmentFile = cfg.environmentFiles;
Restart = "on-failure";
RestartSec = 5;
StateDirectory = "tap";
StateDirectoryMode = "0750";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProcSubset = "pid";
ProtectSystem = "strict";
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
LockPersonality = true;
NoNewPrivileges = true;
AmbientCapabilities = "";
CapabilityBoundingSet = "";
RemoveIPC = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
UMask = "0077";
};
};
};
meta.maintainers = with lib.maintainers; [ blooym ];
}
|
