1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.cross-seed;
inherit (lib)
mkEnableOption
mkPackageOption
mkOption
types
;
settingsFormat = pkgs.formats.json { };
generatedConfig =
pkgs.runCommand "cross-seed-gen-config" { nativeBuildInputs = [ pkgs.cross-seed ]; }
''
export HOME=$(mktemp -d)
cross-seed gen-config
mkdir $out
cp -r $HOME/.cross-seed/config.js $out/
'';
in
{
options.services.cross-seed = {
enable = mkEnableOption "cross-seed";
package = mkPackageOption pkgs "cross-seed" { };
user = mkOption {
type = types.str;
default = "cross-seed";
description = "User to run cross-seed as.";
};
group = mkOption {
type = types.str;
default = "cross-seed";
example = "torrents";
description = "Group to run cross-seed as.";
};
configDir = mkOption {
type = types.path;
default = "/var/lib/cross-seed";
description = "Cross-seed config directory";
};
useGenConfigDefaults = mkOption {
type = types.bool;
default = false;
description = ''
Whether to use the option defaults from the configuration generated by
{command}`cross-seed gen-config`.
Those are the settings recommended by the project, and can be inspected
from their [template file](https://github.com/cross-seed/cross-seed/blob/master/src/config.template.cjs).
Settings set in {option}`services.cross-seed.settings` and
{option}`services.cross-seed.settingsFile` will override the ones from
this option.
'';
};
settings = mkOption {
default = { };
type = types.submodule {
freeformType = settingsFormat.type;
options = {
dataDirs = mkOption {
type = types.listOf types.path;
default = [ ];
description = ''
Paths to be searched for matching data.
If you use Injection, cross-seed will use the specified linkType
to create a link to the original file in the linkDirs.
If linkType is hardlink, these must be on the same volume as the
data.
'';
};
linkDirs = mkOption {
type = types.listOf types.path;
default = [ ];
description = ''
List of directories where cross-seed will create links.
If linkType is hardlink, these must be on the same volume as the data.
'';
};
torrentDir = mkOption {
type = types.nullOr types.path;
default = null;
description = ''
Directory containing torrent files, or if you're using a torrent
client integration and injection - your torrent client's .torrent
file store/cache.
'';
};
outputDir = mkOption {
type = types.nullOr types.path;
default = "${cfg.configDir}/output";
defaultText = "\${cfg.configDir}/output";
description = "Directory where cross-seed will place torrent files it finds.";
};
port = mkOption {
type = types.port;
default = 2468;
example = 3000;
description = "Port the cross-seed daemon listens on.";
};
};
};
description = ''
Configuration options for cross-seed.
Secrets should not be set in this option, as they will be available in
the Nix store. For secrets, please use settingsFile.
For more details, see [the cross-seed documentation](https://www.cross-seed.org/docs/basics/options).
'';
};
settingsFile = lib.mkOption {
default = null;
type = types.nullOr types.path;
description = ''
Path to a JSON file containing settings that will be merged with the
settings option. This is suitable for storing secrets, as they will not
be exposed on the Nix store.
'';
};
};
config =
let
jsonSettingsFile = settingsFormat.generate "settings.json" cfg.settings;
genConfigSegment =
lib.optionalString cfg.useGenConfigDefaults # js
''
const gen_config_js = "${generatedConfig}/config.js";
Object.assign(loaded_settings, require(gen_config_js));
'';
# Since cross-seed uses a javascript config file, we can use node's
# ability to parse JSON directly to avoid having to do any conversion.
# This also means we don't need to use any external programs to merge the
# secrets.
secretSettingsSegment =
lib.optionalString (cfg.settingsFile != null) # js
''
const path = require("node:path");
const secret_settings_json = path.join(process.env.CREDENTIALS_DIRECTORY, "secretSettingsFile");
Object.assign(loaded_settings, JSON.parse(fs.readFileSync(secret_settings_json, "utf8")));
'';
javascriptConfig =
pkgs.writeText "config.js" # js
''
"use strict";
const fs = require("fs");
const settings_json = "${jsonSettingsFile}";
let loaded_settings = {};
${genConfigSegment}
Object.assign(loaded_settings, JSON.parse(fs.readFileSync(settings_json, "utf8")));
${secretSettingsSegment}
module.exports = loaded_settings;
'';
in
lib.mkIf (cfg.enable) {
assertions = [
{
assertion = !(cfg.settings ? apiKey);
message = ''
The API key should be set via the settingsFile option, to avoid
exposing it on the Nix store.
'';
}
];
systemd.tmpfiles.settings."10-cross-seed" = {
${cfg.configDir}.d = {
inherit (cfg) group user;
mode = "700";
};
}
// lib.optionalAttrs (cfg.settings.outputDir != null) {
${cfg.settings.outputDir}.d = {
inherit (cfg) group user;
mode = "750";
};
};
systemd.services.cross-seed = {
description = "cross-seed";
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
environment.CONFIG_DIR = cfg.configDir;
preStart = ''
install -D -m 600 -o '${cfg.user}' -g '${cfg.group}' '${javascriptConfig}' '${cfg.configDir}/config.js'
'';
serviceConfig = {
ExecStart = "${lib.getExe cfg.package} daemon";
User = cfg.user;
Group = cfg.group;
# Only allow binding to the specified port.
SocketBindDeny = "any";
SocketBindAllow = cfg.settings.port;
LoadCredential = lib.mkIf (cfg.settingsFile != null) "secretSettingsFile:${cfg.settingsFile}";
StateDirectory = "cross-seed";
ReadWritePaths = lib.optional (cfg.settings.outputDir != null) cfg.settings.outputDir;
ReadOnlyPaths = lib.optional (cfg.settings.torrentDir != null) cfg.settings.torrentDir;
};
unitConfig = {
# Unfortunately, we can not protect these if we are to hardlink between them, as they need to be on the same volume for hardlinks to work.
RequiresMountsFor = lib.flatten [
cfg.settings.dataDirs
cfg.settings.linkDirs
(lib.optional (cfg.settings.outputDir != null) cfg.settings.outputDir)
];
};
};
# It's useful to have the package in the path, to be able to e.g. get the API key.
environment.systemPackages = [ cfg.package ];
users.users = lib.mkIf (cfg.user == "cross-seed") {
cross-seed = {
group = cfg.group;
description = "cross-seed user";
isSystemUser = true;
home = cfg.configDir;
};
};
users.groups = lib.mkIf (cfg.group == "cross-seed") {
cross-seed = { };
};
};
}
|
