flake/nixos/modules/services/pixivfe.nix

{
  lib,
  config,
  inputs,
  pkgs,
  ...
}:
let
  cfg = config.services.pixivfe;
in
{
  options.services.pixivfe = {
    enable = lib.mkEnableOption "PixivFE, a privacy respecting frontend for Pixiv";

    package =
      lib.mkPackageOption inputs.self.legacyPackages.${pkgs.stdenv.hostPlatform.system} "pixivfe"
        { };

    openFirewall = lib.mkEnableOption "open ports in the firewall needed for the daemon to function";

    settings = lib.mkOption {
      type = lib.types.nullOr (lib.types.attrsOf lib.types.anything);
      default = null;
      example = lib.literalExpression ''
        {
          PIXIVFE_PORT = "8282";
          PIXIVFE_TOKEN = "123456_AaBbccDDeeFFggHHIiJjkkllmMnnooPP";
        };
      '';
      description = ''
        Additional configuration for PixivFE, see
        <https://pixivfe.pages.dev/environment-variables/> for supported values.
        For secrets use `EnvironmentFile` option instead.
      '';
    };

    EnvironmentFile = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = lib.literalExpression ''
        /run/secrets/environment
      '';
      description = ''
        File containing environment variables to be passed to the PixivFE service.

        See `systemd.exec(5)` for more information.
      '';
    };
  };
  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = if cfg.openFirewall then (cfg.settings ? PIXIVFE_PORT) else true;
        message = ''
          PIXIVFE_PORT must be specified for NixOS to open a port.

          See https://pixivfe.pages.dev/environment-variables/ for more information.
        '';
      }
      {
        assertion =
          if (cfg.EnvironmentFile == null) then
            (cfg.settings ? PIXIVFE_UNIXSOCKET) || (cfg.settings ? PIXIVFE_PORT)
          else
            true;
        message = ''
          PIXIVFE_PORT or PIXIVFE_UNIXSOCKET must be set for PixivFE to run.

          See https://pixivfe.pages.dev/environment-variables/ for more information.
        '';
      }
      {
        assertion = if (cfg.EnvironmentFile == null) then cfg.settings ? PIXIVFE_TOKEN else true;
        message = ''
          PIXIVFE_TOKEN must be set for PixivFE to run.

          See https://pixivfe.pages.dev/environment-variables/ for more information.
        '';
      }
    ];

    systemd.services."pixivfe" = {
      description = "PixivFE, a privacy respecting frontend for Pixiv.";
      documentation = [ "https://pixivfe.pages.dev/" ];
      wantedBy = [ "multi-user.target" ];
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      environment = lib.mkIf (cfg.settings != null) (
        lib.mapAttrs (_: v: if lib.isBool v then lib.boolToString v else toString v) cfg.settings
      );
      serviceConfig = {
        inherit (cfg) EnvironmentFile;
        ExecStart = lib.getExe cfg.package;
        DynamicUser = true;

        ### Hardening
        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; # For ports <= 1024
        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
        NoNewPrivileges = true;
        PrivateMounts = true;
        PrivateTmp = true;
        ProcSubset = "pid";
        ProtectClock = true;
        ProtectControlGroups = true;
        ProtectHome = true;
        ProtectHostname = true;
        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
        ProtectProc = "invisible";
        ProtectSystem = "strict";
        RestrictNamespaces = true;
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
        SystemCallArchitectures = "native";
        SystemCallFilter = "@system-service";
        UMask = "0077";
      };
    };

    networking.firewall = lib.mkIf cfg.openFirewall {
      allowedTCPPorts = [ cfg.settings.PIXIVFE_PORT ];
    };
  };
}