60 lines
1.4 KiB
Nix
60 lines
1.4 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
...
|
|
}: let
|
|
etcDirectory = "juicity";
|
|
port = "33829";
|
|
in {
|
|
imports = [
|
|
../../../../../flakes/nixos/sops-nix.nix
|
|
];
|
|
|
|
### Firewall
|
|
networking.firewall = {
|
|
allowedTCPPorts = [port];
|
|
allowedUDPPorts = [port];
|
|
};
|
|
|
|
#### sops-nix
|
|
sops.secrets."juicity-config" = {
|
|
owner = config.users.users."juicity".name;
|
|
group = config.users.groups."juicity".name;
|
|
restartUnits = ["juicity-server.service"];
|
|
path = "/etc/${etcDirectory}/config.yaml";
|
|
};
|
|
|
|
### User running proxy service
|
|
users.groups."juicity" = {};
|
|
users.users."juicity" = {
|
|
isSystemUser = true;
|
|
group = config.users.groups."juicity".name;
|
|
};
|
|
|
|
### Proxy service
|
|
systemd.services."juicity-server" = {
|
|
description = "Juicity Server";
|
|
after = ["network.target"];
|
|
|
|
wantedBy = ["multi-user.target"];
|
|
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
WorkingDirectory = "/etc/${etcDirectory}";
|
|
User = [config.users.users."juicity".name];
|
|
Group = [config.users.groups."juicity".name];
|
|
ExecStart = "${pkgs.juicity}/bin/juicity-server run -c /etc/${etcDirectory}/config.json";
|
|
Restart = "on-failure";
|
|
CapabilityBoundingSet = [
|
|
"CAP_NET_ADMIN"
|
|
"CAP_NET_BIND_SERVICE"
|
|
"CAP_NET_RAW"
|
|
];
|
|
AmbientCapabilities = [
|
|
"CAP_NET_ADMIN"
|
|
"CAP_NET_BIND_SERVICE"
|
|
"CAP_NET_RAW"
|
|
];
|
|
};
|
|
};
|
|
}
|