diff --git a/hosts/profiles/gpodder/default.nix b/hosts/profiles/gpodder/default.nix new file mode 100644 index 0000000..bc30455 --- /dev/null +++ b/hosts/profiles/gpodder/default.nix @@ -0,0 +1,4 @@ +{ + services.gpodder.enable = true; + networking.firewall.allowedTCPPorts = [ 3005 ]; +} diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index 38962ff..cf3f7fe 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -9,6 +9,6 @@ wireguard = import ./wireguard.nix; backup = import ./backup.nix; ulogger-server = import ./ulogger.nix; - blogg = import ./blogging.nix; + gpodder2go = import ./gpodder2go.nix; # microbin = import ./microbin.nix; # includide in 23.11 } diff --git a/modules/nixos/gpodder2go.nix b/modules/nixos/gpodder2go.nix new file mode 100644 index 0000000..4621996 --- /dev/null +++ b/modules/nixos/gpodder2go.nix @@ -0,0 +1,114 @@ +{ self, config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.gpodder2go; +in +{ + options = { + + services.gpodder = { + enable = mkEnableOption "A gpodder instance"; + + user = mkOption { + type = types.str; + default = "gpodder"; + description = "User account under which gpodder runs."; + }; + + group = mkOption { + type = types.str; + default = "gpodder"; + description = "Group account under which gpodder runs."; + }; + + hostname = mkOption { + type = types.str; + description = "Hostname of your gpodder service"; + }; + + dataFolder = mkOption { + type = types.str; + default = "/var/lib/gpodder"; + description = "State director"; + }; + + VERIFIER_SECRET_KEY = mkOption { + type = types.str; + default = "satnheiycglsrcgaecrlufg"; + description = "Verifer Secret"; + }; + + }; + }; + + config = mkIf cfg.enable { + systemd.services.gpodder = { + description = "gpodder2go A gpodder instance"; + after = [ "remote-fs.target" "network.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${pkgs.gpodder2go}/bin/gpodder2go serve"; + Environment = [ + "VERIFIER_SECRET_KEY=${cfg.VERIFIER_SECRET_KEY}" + ]; + WorkingDirectory = dataFolder; + TimeoutStopSec = " 20 "; + KillMode = " process "; + RestartSec = " 10 "; + User = cfg.user; + Group = cfg.group; + DevicePolicy = " closed "; + NoNewPrivileges = " yes "; + PrivateTmp = " yes "; + PrivateUsers = " yes "; + ProtectControlGroups = " yes "; + ProtectKernelModules = " yes "; + ProtectKernelTunables = " yes "; + RestrictAddressFamilies = " + AF_UNIX + AF_INET + AF_INET6 "; + RestrictNamespaces = " yes "; + RestrictRealtime = " yes "; + SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap"; + ReadWritePaths = dataFolder; + StateDirectory = baseNameOf dataFolder; + }; + }; + + users.users = optionalAttrs (cfg.user == "gpodder") ({ + gpodder = { + description = "gpodder service user"; + name = cfg.user; + group = cfg.group; + isSystemUser = true; + }; + }); + + users.groups = optionalAttrs (cfg.group == "gpodder") ({ + gpodder = { }; + }); + }; + + systemd.services.gpodder-install = { + description = "gpodder install service"; + wantedBy = [ "multi-user.target" ]; + before = [ "gpodder.service" ]; + path = with pkgs; [ gpodder2go ]; + + serviceConfig = { + User = cfg.user; + Type = "oneshot"; + } // commonServiceConfig; + + script = '' + if [ ! -f "${cfg.dataFolder}/installed" ]; then + ${pkgs.gpodder2go}/bin/gpodder2go init + touch "${cfg.dataFolder}/installed" + fi + ''; + }; +} + diff --git a/pkgs/default.nix b/pkgs/default.nix index 8a5ef55..5f20de2 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -5,7 +5,7 @@ plymouth-themes = pkgs.callPackage ./plymouth.nix { }; tic-80 = pkgs.callPackage ./tic-80.nix { }; fennel-ls = pkgs.callPackage ./fennel-ls.nix { }; - kobopatch = pkgs.callPackage ./kobopatch.nix { }; + # kobopatch = pkgs.callPackage ./kobopatch.nix { }; my-mautrix-discord = pkgs.callPackage ./mautrix-discord.nix { }; # Handled by matrix-appservices input ulogger-server = pkgs.callPackage ./ulogger.nix { }; # Wallabag is now an overlay @@ -13,5 +13,4 @@ my-wallabag = pkgs.callPackage ./wallabag.nix { }; mautrix-slack = pkgs.callPackage ./mautrix-slack.nix { }; gpodder2go = pkgs.callPackage ./gpodder2go.nix { }; - ghost = pkgs.callPackage ./ghost { }; }