Coffee journaling on ATProto (alpha)
alpha.arabica.social
coffee
feat: nix derivation and flake package
+150
-53
+46
default.nix
+46
default.nix
···
1
+
{ lib, buildGoModule, tailwindcss }:
2
+
3
+
buildGoModule rec {
4
+
pname = "arabica";
5
+
version = "0.1.0";
6
+
src = ./.;
7
+
vendorHash = "sha256-4Z6KAxox3EY9RGtFKUcqxtB/kj3Ed+o+ggPwtLSPctU=";
8
+
9
+
nativeBuildInputs = [ tailwindcss ];
10
+
11
+
preBuild = ''
12
+
tailwindcss -i web/static/css/style.css -o web/static/css/output.css --minify
13
+
'';
14
+
15
+
buildPhase = ''
16
+
runHook preBuild
17
+
go build -o arabica cmd/server/main.go
18
+
runHook postBuild
19
+
'';
20
+
21
+
installPhase = ''
22
+
mkdir -p $out/bin
23
+
mkdir -p $out/share/arabica
24
+
25
+
# Copy static files, migrations, and templates
26
+
cp -r web $out/share/arabica/
27
+
cp -r migrations $out/share/arabica/
28
+
cp -r internal $out/share/arabica/
29
+
cp arabica $out/bin/arabica-unwrapped
30
+
cat > $out/bin/arabica <<'EOF'
31
+
#!/bin/sh
32
+
SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
33
+
SHARE_DIR="$SCRIPT_DIR/../share/arabica"
34
+
cd "$SHARE_DIR"
35
+
exec "$SCRIPT_DIR/arabica-unwrapped" "$@"
36
+
EOF
37
+
chmod +x $out/bin/arabica
38
+
'';
39
+
40
+
meta = with lib; {
41
+
description = "Arabica - Coffee brew tracker";
42
+
license = licenses.mit;
43
+
platforms = platforms.linux;
44
+
mainProgram = "arabica";
45
+
};
46
+
}
+4
-53
flake.nix
+4
-53
flake.nix
···
1
1
{
2
-
description = "Dev Shells Flake";
2
+
description = "Arabica - Coffee brew tracking application";
3
3
inputs = { nixpkgs.url = "nixpkgs/nixpkgs-unstable"; };
4
4
outputs = { nixpkgs, self, ... }:
5
5
let
···
13
13
});
14
14
15
15
packages = forAllSystems (pkgs: system: rec {
16
-
arabica = pkgs.buildGoModule {
17
-
pname = "arabica";
18
-
version = "0.1.0";
19
-
src = ./.;
20
-
21
-
# Vendor hash for Go dependencies
22
-
vendorHash = "sha256-4Z6KAxox3EY9RGtFKUcqxtB/kj3Ed+o+ggPwtLSPctU=";
23
-
24
-
nativeBuildInputs = with pkgs; [ tailwindcss ];
25
-
26
-
preBuild = ''
27
-
# Build Tailwind CSS
28
-
tailwindcss -i web/static/css/style.css -o web/static/css/output.css --minify
29
-
'';
30
-
31
-
# Build output goes to bin/arabica
32
-
buildPhase = ''
33
-
runHook preBuild
34
-
go build -o arabica cmd/server/main.go
35
-
runHook postBuild
36
-
'';
37
-
38
-
installPhase = ''
39
-
mkdir -p $out/bin
40
-
mkdir -p $out/share/arabica
41
-
42
-
# Copy static files, migrations, and templates
43
-
cp -r web $out/share/arabica/
44
-
cp -r migrations $out/share/arabica/
45
-
cp -r internal $out/share/arabica/
46
-
47
-
# Install the actual binary
48
-
cp arabica $out/bin/arabica-unwrapped
49
-
50
-
# Create wrapper script that changes to the share directory
51
-
cat > $out/bin/arabica <<'EOF'
52
-
#!/bin/sh
53
-
SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
54
-
SHARE_DIR="$SCRIPT_DIR/../share/arabica"
55
-
cd "$SHARE_DIR"
56
-
exec "$SCRIPT_DIR/arabica-unwrapped" "$@"
57
-
EOF
58
-
chmod +x $out/bin/arabica
59
-
'';
60
-
61
-
meta = with pkgs.lib; {
62
-
description = "Arabica - Coffee brew tracker";
63
-
license = licenses.mit;
64
-
platforms = platforms.linux;
65
-
};
66
-
};
67
-
16
+
arabica = pkgs.callPackage ./default.nix { };
68
17
default = arabica;
69
18
});
70
19
···
74
23
program = "${self.packages.${system}.arabica}/bin/arabica";
75
24
};
76
25
});
26
+
27
+
nixosModules.default = import ./module.nix;
77
28
};
78
29
}
+100
module.nix
+100
module.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
let cfg = config.services.arabica;
4
+
in {
5
+
options.services.arabica = {
6
+
enable = lib.mkEnableOption "Arabica coffee brew tracking service";
7
+
8
+
package = lib.mkOption {
9
+
type = lib.types.package;
10
+
default = pkgs.callPackage ./default.nix { };
11
+
defaultText = lib.literalExpression "pkgs.callPackage ./default.nix { }";
12
+
description = "The arabica package to use.";
13
+
};
14
+
15
+
settings = {
16
+
port = lib.mkOption {
17
+
type = lib.types.port;
18
+
default = 18910;
19
+
description = "Port on which the arabica server listens.";
20
+
};
21
+
};
22
+
23
+
dataDir = lib.mkOption {
24
+
type = lib.types.path;
25
+
default = "/var/lib/arabica";
26
+
description = "Directory where arabica stores its database.";
27
+
};
28
+
29
+
user = lib.mkOption {
30
+
type = lib.types.str;
31
+
default = "arabica";
32
+
description = "User account under which arabica runs.";
33
+
};
34
+
35
+
group = lib.mkOption {
36
+
type = lib.types.str;
37
+
default = "arabica";
38
+
description = "Group under which arabica runs.";
39
+
};
40
+
41
+
openFirewall = lib.mkOption {
42
+
type = lib.types.bool;
43
+
default = false;
44
+
description = "Whether to open the firewall for the arabica port.";
45
+
};
46
+
};
47
+
48
+
config = lib.mkIf cfg.enable {
49
+
users.users.${cfg.user} = lib.mkIf (cfg.user == "arabica") {
50
+
isSystemUser = true;
51
+
group = cfg.group;
52
+
description = "Arabica service user";
53
+
home = cfg.dataDir;
54
+
createHome = true;
55
+
};
56
+
57
+
users.groups.${cfg.group} = lib.mkIf (cfg.group == "arabica") { };
58
+
59
+
systemd.services.arabica = {
60
+
description = "Arabica Coffee Brew Tracking Service";
61
+
wantedBy = [ "multi-user.target" ];
62
+
after = [ "network.target" ];
63
+
64
+
serviceConfig = {
65
+
Type = "simple";
66
+
User = cfg.user;
67
+
Group = cfg.group;
68
+
ExecStart = "${cfg.package}/bin/arabica";
69
+
Restart = "on-failure";
70
+
RestartSec = "10s";
71
+
72
+
# Security hardening
73
+
NoNewPrivileges = true;
74
+
PrivateTmp = true;
75
+
ProtectSystem = "strict";
76
+
ProtectHome = true;
77
+
ReadWritePaths = [ cfg.dataDir ];
78
+
ProtectKernelTunables = true;
79
+
ProtectKernelModules = true;
80
+
ProtectControlGroups = true;
81
+
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
82
+
RestrictNamespaces = true;
83
+
LockPersonality = true;
84
+
RestrictRealtime = true;
85
+
RestrictSUIDSGID = true;
86
+
MemoryDenyWriteExecute = true;
87
+
SystemCallArchitectures = "native";
88
+
CapabilityBoundingSet = "";
89
+
};
90
+
91
+
environment = {
92
+
PORT = toString cfg.settings.port;
93
+
DB_PATH = "${cfg.dataDir}/arabica.db";
94
+
};
95
+
};
96
+
97
+
networking.firewall =
98
+
lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.settings.port ]; };
99
+
};
100
+
}