Something went wrong. Try again.
An ATProto Powered Reputation Network
Something went wrong. Try again.
4.5 kB · 151 lines
Nix
at master
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152{ lib }:let validSecret = path: path != null && lib.hasPrefix "/" path && !(lib.hasPrefix "/nix/store/" path) && !(lib.hasInfix "\n" path) && !(lib.hasInfix "\r" path);in{ inherit validSecret;
dataOption = stateDirectory: lib.mkOption { type = lib.types.addCheck (lib.types.strMatching "/[a-zA-Z0-9_./-]+") ( path: !(lib.hasPrefix "/nix/store/" path) && lib.all (part: part != "" && part != "." && part != "..") (lib.tail (lib.splitString "/" path)) ); default = "/var/lib/${stateDirectory}"; description = "Absolute runtime data directory as a string, not a Nix path. Custom directories use a persistent service user."; };
dataConfig = binary: stateDirectory: dataDirectory: lib.mkIf (dataDirectory != "/var/lib/${stateDirectory}") { users.groups."provenance-${binary}" = { }; users.users."provenance-${binary}" = { isSystemUser = true; group = "provenance-${binary}"; }; systemd.tmpfiles.rules = [ "d ${dataDirectory} 0700 provenance-${binary} provenance-${binary} - -" ]; };
logLevelOption = lib.mkOption { type = lib.types.enum [ "debug" "info" "warn" "error" ]; default = "info"; description = "Minimum structured log level. Debug includes requests and committed replay batches."; };
externalWorkersOption = lib.mkOption { type = lib.types.ints.between 1 64; default = 4; description = "Maximum external HTTP workers in this process. Response reads and retry waits occupy a worker."; };
secretOption = description: lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; inherit description; example = "/run/secrets/provenance/service-key"; };
stateOption = name: lib.mkOption { type = lib.types.strMatching "[a-zA-Z0-9_-]+"; default = name; description = "Name of the private systemd state directory under /var/lib."; };
databaseOption = name: lib.mkOption { type = lib.types.strMatching "[a-zA-Z0-9_-][a-zA-Z0-9._-]*"; default = name; description = "SQLite filename within the managed state directory."; };
# Load only credential paths into the unit. Secret contents enter the process at runtime. unit = { package, binary, stateDirectory, environment, credentials, dataDirectory ? "/var/lib/${stateDirectory}", }: { wantedBy = [ "multi-user.target" ]; wants = [ "network-online.target" ]; after = [ "network-online.target" ]; inherit environment; unitConfig.RequiresMountsFor = [ dataDirectory ]; script = lib.concatMapStringsSep "\n" (name: '' ${ if name == "JETSTREAM_API_KEY_FILE" then ''export ${name}="$CREDENTIALS_DIRECTORY/${name}"'' else ''export ${name}="$(< "$CREDENTIALS_DIRECTORY/${name}")"'' } '') (builtins.attrNames credentials) + '' exec ${package}/bin/${binary} '';
serviceConfig = { LoadCredential = lib.mapAttrsToList (name: path: "${name}:${path}") ( lib.filterAttrs (_: path: path != null) credentials ); DynamicUser = true; StateDirectory = stateDirectory; StateDirectoryMode = "0700"; WorkingDirectory = dataDirectory; UMask = "0077"; Restart = "on-failure"; RestartSec = 5; TimeoutStopSec = 15; NoNewPrivileges = true; ProtectSystem = "strict"; ProtectHome = true; PrivateTmp = true; PrivateDevices = true; ProtectClock = true; ProtectKernelTunables = true; ProtectKernelModules = true; ProtectControlGroups = true; RestrictSUIDSGID = true; RestrictRealtime = true; LockPersonality = true; MemoryDenyWriteExecute = true; CapabilityBoundingSet = ""; AmbientCapabilities = ""; RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ]; } // lib.optionalAttrs (dataDirectory != "/var/lib/${stateDirectory}") { DynamicUser = false; User = "provenance-${binary}"; Group = "provenance-${binary}"; ReadWritePaths = [ dataDirectory ]; }; };}