likely-music-service.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

{ config, lib, pkgs, ... }:

let

  lpkgs = import ./pkgs.nix {
    inherit pkgs;
  };

  cfg = config.services.likely-music;

in {
  options.services.likely-music = {
    enable = lib.mkEnableOption "likely-music";
    virtualHost = lib.mkOption {
      type = lib.types.str;
      default = "localhost";
    };
  };

  config = lib.mkIf cfg.enable {
    systemd.services.likely-music = {
      description = "likely-music web server";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
        Type = "simple";
        ExecStart = "${lpkgs.likely-music}/bin/likely-music";

        PrivateTmp = true;
        TemporaryFileSystem= "/:ro";
        BindReadOnlyPaths = "/nix";

        NoNewPrivileges = true;
        RestrictRealtime = true;
        LockPersonality = true;

        DynamicUser = true;

        ProtectSystem = "strict";
        ProtectHome = true;
        PrivateUsers = true;
        ProtectKernelTunables = true;
        ProtectKernelModules = true;
        ProtectControlGroups = true;
        ProtectKernelLogs = true;
        MemoryDenyWriteExecute = true;
        PrivateDevices = true;
        PrivateMounts = true;
      };
    };

    services.nginx.virtualHosts."${cfg.virtualHost}" = {
      enableACME = true;
      forceSSL = true;
      extraConfig = ''
        location / {
        proxy_pass http://localhost:8081/;
        }
      '';
    };
  };
}