flake/nixos/modules/services/pixivfe.nix

125 lines
3.8 KiB
Nix

{
lib,
config,
inputs,
pkgs,
...
}:
let
cfg = config.services.pixivfe;
in
{
options.services.pixivfe = {
enable = lib.mkEnableOption "PixivFE, a privacy respecting frontend for Pixiv";
package =
lib.mkPackageOption inputs.self.legacyPackages.${pkgs.stdenv.hostPlatform.system} "pixivfe"
{ };
openFirewall = lib.mkEnableOption "open ports in the firewall needed for the daemon to function";
settings = lib.mkOption {
type = lib.types.nullOr (lib.types.attrsOf lib.types.anything);
default = null;
example = lib.literalExpression ''
{
PIXIVFE_PORT = "8282";
PIXIVFE_TOKEN = "123456_AaBbccDDeeFFggHHIiJjkkllmMnnooPP";
};
'';
description = ''
Additional configuration for PixivFE, see
<https://pixivfe.pages.dev/environment-variables/> for supported values.
For secrets use `EnvironmentFile` option instead.
'';
};
EnvironmentFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = lib.literalExpression ''
/run/secrets/environment
'';
description = ''
File containing environment variables to be passed to the PixivFE service.
See `systemd.exec(5)` for more information.
'';
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = if cfg.openFirewall then (cfg.settings ? PIXIVFE_PORT) else true;
message = ''
PIXIVFE_PORT must be specified for NixOS to open a port.
See https://pixivfe.pages.dev/environment-variables/ for more information.
'';
}
{
assertion =
if (cfg.EnvironmentFile == null) then
(cfg.settings ? PIXIVFE_UNIXSOCKET) || (cfg.settings ? PIXIVFE_PORT)
else
true;
message = ''
PIXIVFE_PORT or PIXIVFE_UNIXSOCKET must be set for PixivFE to run.
See https://pixivfe.pages.dev/environment-variables/ for more information.
'';
}
{
assertion = if (cfg.EnvironmentFile == null) then cfg.settings ? PIXIVFE_TOKEN else true;
message = ''
PIXIVFE_TOKEN must be set for PixivFE to run.
See https://pixivfe.pages.dev/environment-variables/ for more information.
'';
}
];
systemd.services."pixivfe" = {
description = "PixivFE, a privacy respecting frontend for Pixiv.";
documentation = [ "https://pixivfe.pages.dev/" ];
wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
environment = lib.mkIf (cfg.settings != null) (
lib.mapAttrs (_: v: if lib.isBool v then lib.boolToString v else toString v) cfg.settings
);
serviceConfig = {
inherit (cfg) EnvironmentFile;
ExecStart = lib.getExe cfg.package;
DynamicUser = true;
### Hardening
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; # For ports <= 1024
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
NoNewPrivileges = true;
PrivateMounts = true;
PrivateTmp = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
UMask = "0077";
};
};
networking.firewall = lib.mkIf cfg.openFirewall {
allowedTCPPorts = [ cfg.settings.PIXIVFE_PORT ];
};
};
}