125 lines
3.8 KiB
Nix
125 lines
3.8 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
inputs,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.pixivfe;
|
|
in
|
|
{
|
|
options.services.pixivfe = {
|
|
enable = lib.mkEnableOption "PixivFE, a privacy respecting frontend for Pixiv";
|
|
|
|
package =
|
|
lib.mkPackageOption inputs.self.legacyPackages.${pkgs.stdenv.hostPlatform.system} "pixivfe"
|
|
{ };
|
|
|
|
openFirewall = lib.mkEnableOption "open ports in the firewall needed for the daemon to function";
|
|
|
|
settings = lib.mkOption {
|
|
type = lib.types.nullOr (lib.types.attrsOf lib.types.anything);
|
|
default = null;
|
|
example = lib.literalExpression ''
|
|
{
|
|
PIXIVFE_PORT = "8282";
|
|
PIXIVFE_TOKEN = "123456_AaBbccDDeeFFggHHIiJjkkllmMnnooPP";
|
|
};
|
|
'';
|
|
description = ''
|
|
Additional configuration for PixivFE, see
|
|
<https://pixivfe.pages.dev/environment-variables/> for supported values.
|
|
For secrets use `EnvironmentFile` option instead.
|
|
'';
|
|
};
|
|
|
|
EnvironmentFile = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
default = null;
|
|
example = lib.literalExpression ''
|
|
/run/secrets/environment
|
|
'';
|
|
description = ''
|
|
File containing environment variables to be passed to the PixivFE service.
|
|
|
|
See `systemd.exec(5)` for more information.
|
|
'';
|
|
};
|
|
};
|
|
config = lib.mkIf cfg.enable {
|
|
assertions = [
|
|
{
|
|
assertion = if cfg.openFirewall then (cfg.settings ? PIXIVFE_PORT) else true;
|
|
message = ''
|
|
PIXIVFE_PORT must be specified for NixOS to open a port.
|
|
|
|
See https://pixivfe.pages.dev/environment-variables/ for more information.
|
|
'';
|
|
}
|
|
{
|
|
assertion =
|
|
if (cfg.EnvironmentFile == null) then
|
|
(cfg.settings ? PIXIVFE_UNIXSOCKET) || (cfg.settings ? PIXIVFE_PORT)
|
|
else
|
|
true;
|
|
message = ''
|
|
PIXIVFE_PORT or PIXIVFE_UNIXSOCKET must be set for PixivFE to run.
|
|
|
|
See https://pixivfe.pages.dev/environment-variables/ for more information.
|
|
'';
|
|
}
|
|
{
|
|
assertion = if (cfg.EnvironmentFile == null) then cfg.settings ? PIXIVFE_TOKEN else true;
|
|
message = ''
|
|
PIXIVFE_TOKEN must be set for PixivFE to run.
|
|
|
|
See https://pixivfe.pages.dev/environment-variables/ for more information.
|
|
'';
|
|
}
|
|
];
|
|
|
|
systemd.services."pixivfe" = {
|
|
description = "PixivFE, a privacy respecting frontend for Pixiv.";
|
|
documentation = [ "https://pixivfe.pages.dev/" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
environment = lib.mkIf (cfg.settings != null) (
|
|
lib.mapAttrs (_: v: if lib.isBool v then lib.boolToString v else toString v) cfg.settings
|
|
);
|
|
serviceConfig = {
|
|
inherit (cfg) EnvironmentFile;
|
|
ExecStart = lib.getExe cfg.package;
|
|
DynamicUser = true;
|
|
|
|
### Hardening
|
|
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; # For ports <= 1024
|
|
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
|
NoNewPrivileges = true;
|
|
PrivateMounts = true;
|
|
PrivateTmp = true;
|
|
ProcSubset = "pid";
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectProc = "invisible";
|
|
ProtectSystem = "strict";
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallFilter = "@system-service";
|
|
UMask = "0077";
|
|
};
|
|
};
|
|
|
|
networking.firewall = lib.mkIf cfg.openFirewall {
|
|
allowedTCPPorts = [ cfg.settings.PIXIVFE_PORT ];
|
|
};
|
|
};
|
|
}
|