this repo has no description
add microbin to helix (create module)
+104
+1
hosts/helix/default.nix
+1
hosts/helix/default.nix
+18
hosts/profiles/microbin/default.nix
+18
hosts/profiles/microbin/default.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.microbin.enable = true;
4
+
services.microbin.hostname = "bin.sealight.xyz";
5
+
services.microbin.port = 4949;
6
+
networking.firewall.allowedTCPPorts = [ 4949 ];
7
+
services.nginx.virtualHosts."bin.sealight.xyz" = {
8
+
enableACME = true;
9
+
forceSSL = true;
10
+
11
+
locations."/" = {
12
+
extraConfig = ''
13
+
proxy_pass http://localhost:4949/;
14
+
proxy_set_header X-Forwarded-Host $host;
15
+
'';
16
+
};
17
+
};
18
+
}
+85
modules/nixos/microbin.nix
+85
modules/nixos/microbin.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
with lib;
4
+
5
+
let
6
+
cfg = config.services.microbin;
7
+
configFile = "/etc/microbin/config";
8
+
dataFolder = "/var/lib/microbin";
9
+
in
10
+
{
11
+
options = {
12
+
13
+
services.microbin = {
14
+
enable = mkEnableOption "A super tiny pasta";
15
+
16
+
user = mkOption {
17
+
type = types.str;
18
+
default = "microbin";
19
+
description = "User account under which microbin runs.";
20
+
};
21
+
22
+
group = mkOption {
23
+
type = types.str;
24
+
default = "microbin";
25
+
description = "Group account under which microbin runs.";
26
+
};
27
+
28
+
};
29
+
};
30
+
31
+
config = mkIf cfg.enable {
32
+
systemd.services.microbin = {
33
+
description = "Microbin A Super Tiny Pasta";
34
+
after = [ "remote-fs.target" "network.target" ];
35
+
wantedBy = [ "multi-user.target" ];
36
+
serviceConfig = {
37
+
ExecStart = "${pkgs.microbin}/bin/microbin --port ${cfg.port} \\
38
+
--public-path ${cfg.hostname} \\
39
+
--editable \\
40
+
--enable-burn-after \\
41
+
--private \\
42
+
--qr \\
43
+
--title=sealight \\
44
+
--highlightsyntax";
45
+
WorkingDirectory = dataFolder;
46
+
TimeoutStopSec = " 20 ";
47
+
KillMode = " process ";
48
+
Restart = " on-failure ";
49
+
RestartSec = " 10 ";
50
+
User = cfg.user;
51
+
Group = cfg.group;
52
+
DevicePolicy = " closed ";
53
+
NoNewPrivileges = " yes ";
54
+
PrivateTmp = " yes ";
55
+
PrivateUsers = " yes ";
56
+
ProtectControlGroups = " yes ";
57
+
ProtectKernelModules = " yes ";
58
+
ProtectKernelTunables = " yes ";
59
+
RestrictAddressFamilies = "
60
+
AF_UNIX
61
+
AF_INET
62
+
AF_INET6 ";
63
+
RestrictNamespaces = " yes ";
64
+
RestrictRealtime = " yes ";
65
+
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
66
+
ReadWritePaths = dataFolder;
67
+
StateDirectory = baseNameOf dataFolder;
68
+
};
69
+
};
70
+
71
+
users.users = optionalAttrs (cfg.user == "microbin") ({
72
+
microbin = {
73
+
description = "microbin service user";
74
+
name = cfg.user;
75
+
group = cfg.group;
76
+
isSystemUser = true;
77
+
};
78
+
});
79
+
80
+
users.groups = optionalAttrs (cfg.group == "microbin") ({
81
+
microbin = { };
82
+
});
83
+
};
84
+
}
85
+