From d03a2dcc3a5eba91d21d1655c742a072106e54d6 Mon Sep 17 00:00:00 2001 From: tobinio Date: Thu, 30 Jul 2026 16:16:57 +0200 Subject: [PATCH] run taskline as service --- flake.lock | 35 +++++++++ flake.nix | 1 + hosts/homeserver/services/lightcontrol.nix | 5 ++ hosts/homeserver/services/newt.nix | 5 ++ .../homeserver/services/taskline.compose.yml | 19 ----- hosts/homeserver/services/taskline.nix | 76 +++++++++++++++---- 6 files changed, 108 insertions(+), 33 deletions(-) delete mode 100644 hosts/homeserver/services/taskline.compose.yml diff --git a/flake.lock b/flake.lock index bc25250..ef303de 100644 --- a/flake.lock +++ b/flake.lock @@ -100,6 +100,22 @@ "type": "github" } }, + "nixpkgs_3": { + "locked": { + "lastModified": 1785318670, + "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, "root": { "inputs": { "hydration-notifier": "hydration-notifier", @@ -107,6 +123,7 @@ "nixpkgs-stable": "nixpkgs-stable", "nixpkgs-unstable": "nixpkgs-unstable", "sops-nix": "sops-nix", + "taskline": "taskline", "zen-browser": "zen-browser" } }, @@ -130,6 +147,24 @@ "type": "github" } }, + "taskline": { + "inputs": { + "nixpkgs": "nixpkgs_3" + }, + "locked": { + "lastModified": 1785419130, + "narHash": "sha256-WnBfU8qbxxjl4zZRZucSSAcdTF3xPNig/ucV5ACyqmE=", + "ref": "refs/heads/main", + "rev": "6d9bd3ffdc95d28d90d748a72014c8bbb3017e94", + "revCount": 451, + "type": "git", + "url": "https://tangled.org/tobinio.dev/task-line" + }, + "original": { + "type": "git", + "url": "https://tangled.org/tobinio.dev/task-line" + } + }, "zen-browser": { "inputs": { "nixpkgs": [ diff --git a/flake.nix b/flake.nix index 7a4bf7a..5c44f43 100644 --- a/flake.nix +++ b/flake.nix @@ -11,6 +11,7 @@ }; lightcontrol.url = "git+https://tangled.org/tobinio.dev/light-control"; + taskline.url = "git+https://tangled.org/tobinio.dev/task-line"; zen-browser = { url = "github:youwen5/zen-browser-flake"; diff --git a/hosts/homeserver/services/lightcontrol.nix b/hosts/homeserver/services/lightcontrol.nix index 2650bde..92a86a8 100644 --- a/hosts/homeserver/services/lightcontrol.nix +++ b/hosts/homeserver/services/lightcontrol.nix @@ -14,6 +14,11 @@ "WEB_PORT=8080" "TCP_PORT=1234" ]; + + Restart = "always"; + RestartSec = 5; + + DynamicUser = true; }; }; } diff --git a/hosts/homeserver/services/newt.nix b/hosts/homeserver/services/newt.nix index acbf478..e2898d9 100644 --- a/hosts/homeserver/services/newt.nix +++ b/hosts/homeserver/services/newt.nix @@ -27,6 +27,11 @@ RestartSec = 5; DynamicUser = true; + + ProtectSystem = "strict"; + ProtectHome = true; + NoNewPrivileges = true; + PrivateTmp = true; }; }; } diff --git a/hosts/homeserver/services/taskline.compose.yml b/hosts/homeserver/services/taskline.compose.yml deleted file mode 100644 index f3144f6..0000000 --- a/hosts/homeserver/services/taskline.compose.yml +++ /dev/null @@ -1,19 +0,0 @@ -services: - nuxt: - image: atcr.io/tobinio.dev/task-line/nuxt:v2.4.2 - restart: always - ports: - - 3003:3000 - env_file: - - /run/secrets/rendered/taskline.nuxt.env - volumes: - - /srv/apps/taskline/data:/app/.data - api: - image: atcr.io/tobinio.dev/task-line/api:v2.4.2 - restart: always - ports: - - 3001:8080 - env_file: - - /run/secrets/rendered/taskline.api.env - volumes: - - /srv/apps/taskline/data:/app/.data diff --git a/hosts/homeserver/services/taskline.nix b/hosts/homeserver/services/taskline.nix index 5682456..3591d84 100644 --- a/hosts/homeserver/services/taskline.nix +++ b/hosts/homeserver/services/taskline.nix @@ -1,4 +1,4 @@ -{ config, ... }: +{ config, pkgs, inputs, ... }: { sops.secrets = { nuxt_google_client_id = { }; @@ -13,11 +13,9 @@ api_webpush_private_key = { }; api_auth_api_base = { }; api_self_api_base = { }; - api_database_url = { }; }; - sops.templates."taskline.nuxt.env" = { - content = '' + sops.templates."taskline.nuxt.env".content = '' NUXT_GOOGLE_CLIENT_ID=${config.sops.placeholder.nuxt_google_client_id} NUXT_GOOGLE_CLIENT_SECRET=${config.sops.placeholder.nuxt_google_client_secret} @@ -30,21 +28,71 @@ NUXT_PUBLIC_WEBPUSH_PUBLIC_KEY=${config.sops.placeholder.nuxt_public_webpush_public_key} NUXT_PUBLIC_API_BASE=${config.sops.placeholder.nuxt_public_api_base} - ''; - group = "env-secrets"; - mode = "0440"; - }; + ''; - sops.templates."taskline.api.env" = { - content = '' + sops.templates."taskline.api.env".content = '' API_WEBPUSH_PRIVATE_KEY=${config.sops.placeholder.api_webpush_private_key} API_AUTH_API_BASE=${config.sops.placeholder.api_auth_api_base} API_SELF_API_BASE=${config.sops.placeholder.api_self_api_base} + ''; + + systemd.services.taskline-backend = { + description = "TaskLine Backend"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + environment = { + PORT = "3001"; + API_DATABASE_URL="sqlite:///srv/apps/taskline/data/storage.sqlite?mode=rwc"; + }; + + serviceConfig = { + ExecStart = "${inputs.taskline.packages.${pkgs.system}.backend}/bin/api"; + + EnvironmentFile = config.sops.templates."taskline.api.env".path; + + Restart = "always"; + RestartSec = 5; + + ProtectSystem = "strict"; + ProtectHome = true; + NoNewPrivileges = true; + PrivateTmp = true; + + ReadWritePaths = [ + "/srv/apps/taskline/data" + ]; + }; + }; + + systemd.services.taskline-frontend = { + description = "TaskLine Frontend"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + environment = { + PORT = "3003"; + HOST = "0.0.0.0"; + BETTER_AUTH_DATABASE_PATH="/srv/apps/taskline/data/auth.sqlite"; + }; + + serviceConfig = { + ExecStart = "${pkgs.nodejs_22}/bin/node ${inputs.taskline.packages.${pkgs.system}.frontend}/server/index.mjs"; + + EnvironmentFile = config.sops.templates."taskline.nuxt.env".path; + + Restart = "always"; + RestartSec = 5; + + ProtectSystem = "strict"; + ProtectHome = true; + NoNewPrivileges = true; + PrivateTmp = true; - API_DATABASE_URL=${config.sops.placeholder.api_database_url} - ''; - group = "env-secrets"; - mode = "0440"; + ReadWritePaths = [ + "/srv/apps/taskline/data" + ]; + }; }; } -- 2.51.2