flake: apply nixpkgs-fmt treewide
This commit is contained in:
parent
8c3d03e9cb
commit
b3c0bc9cb0
SSH key fingerprint:
SHA256:oAMyvotlNFraMmZmr+p6AxnNfW/GioTs1pOn3V4tQ7A
13 changed files with 279 additions and 276 deletions
|
|
@ -32,7 +32,7 @@ let
|
|||
within = "1d"; # Keep all archives from the last day
|
||||
daily = 7;
|
||||
weekly = 4;
|
||||
monthly = -1; # Keep at least one archive for each month
|
||||
monthly = -1; # Keep at least one archive for each month
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -50,7 +50,7 @@ in
|
|||
enable = mkBoolOpt true;
|
||||
userEnvironment = mkBoolOpt true;
|
||||
repo = mkOpt str "rsync.net:backups/hosts";
|
||||
excludes = mkOpt (attrsOf (listOf str)) {};
|
||||
excludes = mkOpt (attrsOf (listOf str)) { };
|
||||
extraExcludes = mkOpt (listOf str) [ ];
|
||||
backupTimes = mkOpt (attrsOf str) { };
|
||||
jobs = mkOpt (attrsOf str) { };
|
||||
|
|
|
|||
|
|
@ -33,7 +33,8 @@ in
|
|||
config = mkMerge [
|
||||
{
|
||||
home.home.packages = with pkgs; [
|
||||
(mkIf cfg.prismlauncher.enable cfg.prismlauncher.package) alsa-oss
|
||||
(mkIf cfg.prismlauncher.enable cfg.prismlauncher.package)
|
||||
alsa-oss
|
||||
(mkIf cfg.lutris.enable cfg.lutris.package)
|
||||
(mkIf cfg.olympus.enable cfg.olympus.package)
|
||||
(mkIf cfg.puzzles.enable cfg.puzzles.package)
|
||||
|
|
|
|||
|
|
@ -5,171 +5,171 @@ with lib;
|
|||
let
|
||||
cfg = config.services.matrix-conduit;
|
||||
|
||||
format = pkgs.formats.toml {};
|
||||
format = pkgs.formats.toml { };
|
||||
configFile = format.generate "conduit.toml" cfg.settings;
|
||||
in
|
||||
{
|
||||
disabledModules = [ "services/matrix/conduit.nix" ];
|
||||
{
|
||||
disabledModules = [ "services/matrix/conduit.nix" ];
|
||||
|
||||
options.services.matrix-conduit = {
|
||||
enable = mkEnableOption "matrix-conduit";
|
||||
options.services.matrix-conduit = {
|
||||
enable = mkEnableOption "matrix-conduit";
|
||||
|
||||
dataDir = mkOption {
|
||||
type = types.path;
|
||||
description = "The directory to store conduit data in";
|
||||
default = "/var/lib/matrix-conduit/";
|
||||
};
|
||||
dataDir = mkOption {
|
||||
type = types.path;
|
||||
description = "The directory to store conduit data in";
|
||||
default = "/var/lib/matrix-conduit/";
|
||||
};
|
||||
|
||||
extraEnvironment = mkOption {
|
||||
type = types.attrsOf types.str;
|
||||
description = "Extra Environment variables to pass to the conduit server.";
|
||||
default = {};
|
||||
example = { RUST_BACKTRACE="yes"; };
|
||||
};
|
||||
extraEnvironment = mkOption {
|
||||
type = types.attrsOf types.str;
|
||||
description = "Extra Environment variables to pass to the conduit server.";
|
||||
default = { };
|
||||
example = { RUST_BACKTRACE = "yes"; };
|
||||
};
|
||||
|
||||
package = mkPackageOption pkgs "matrix-conduit" { };
|
||||
package = mkPackageOption pkgs "matrix-conduit" { };
|
||||
|
||||
settings = mkOption {
|
||||
type = types.submodule {
|
||||
freeformType = format.type;
|
||||
options = {
|
||||
global.server_name = mkOption {
|
||||
type = types.str;
|
||||
example = "example.com";
|
||||
description = "The server_name is the name of this server. It is used as a suffix for user # and room ids.";
|
||||
};
|
||||
global.port = mkOption {
|
||||
type = types.port;
|
||||
default = 6167;
|
||||
description = "The port Conduit will be running on. You need to set up a reverse proxy in your web server (e.g. apache or nginx), so all requests to /_matrix on port 443 and 8448 will be forwarded to the Conduit instance running on this port";
|
||||
};
|
||||
global.max_request_size = mkOption {
|
||||
type = types.ints.positive;
|
||||
default = 20000000;
|
||||
description = "Max request size in bytes. Don't forget to also change it in the proxy.";
|
||||
};
|
||||
global.allow_registration = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Whether new users can register on this server.";
|
||||
};
|
||||
global.allow_encryption = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
|
||||
};
|
||||
global.allow_federation = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether this server federates with other servers.
|
||||
'';
|
||||
};
|
||||
global.trusted_servers = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ "matrix.org" ];
|
||||
description = "Servers trusted with signing server keys.";
|
||||
};
|
||||
global.address = mkOption {
|
||||
type = types.str;
|
||||
default = "::1";
|
||||
description = "Address to listen on for connections by the reverse proxy/tls terminator.";
|
||||
};
|
||||
global.database_path = mkOption {
|
||||
type = types.str;
|
||||
default = cfg.dataDir;
|
||||
readOnly = true;
|
||||
description = ''
|
||||
Path to the conduit database, the directory where conduit will save its data.
|
||||
Note that due to using the DynamicUser feature of systemd, this value should not be changed
|
||||
and is set to be read only.
|
||||
'';
|
||||
};
|
||||
global.database_backend = mkOption {
|
||||
type = types.enum [ "sqlite" "rocksdb" ];
|
||||
default = "sqlite";
|
||||
example = "rocksdb";
|
||||
description = ''
|
||||
The database backend for the service. Switching it on an existing
|
||||
instance will require manual migration of data.
|
||||
'';
|
||||
};
|
||||
global.allow_check_for_updates = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to allow Conduit to automatically contact
|
||||
<https://conduit.rs> hourly to check for important Conduit news.
|
||||
settings = mkOption {
|
||||
type = types.submodule {
|
||||
freeformType = format.type;
|
||||
options = {
|
||||
global.server_name = mkOption {
|
||||
type = types.str;
|
||||
example = "example.com";
|
||||
description = "The server_name is the name of this server. It is used as a suffix for user # and room ids.";
|
||||
};
|
||||
global.port = mkOption {
|
||||
type = types.port;
|
||||
default = 6167;
|
||||
description = "The port Conduit will be running on. You need to set up a reverse proxy in your web server (e.g. apache or nginx), so all requests to /_matrix on port 443 and 8448 will be forwarded to the Conduit instance running on this port";
|
||||
};
|
||||
global.max_request_size = mkOption {
|
||||
type = types.ints.positive;
|
||||
default = 20000000;
|
||||
description = "Max request size in bytes. Don't forget to also change it in the proxy.";
|
||||
};
|
||||
global.allow_registration = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Whether new users can register on this server.";
|
||||
};
|
||||
global.allow_encryption = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
|
||||
};
|
||||
global.allow_federation = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether this server federates with other servers.
|
||||
'';
|
||||
};
|
||||
global.trusted_servers = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ "matrix.org" ];
|
||||
description = "Servers trusted with signing server keys.";
|
||||
};
|
||||
global.address = mkOption {
|
||||
type = types.str;
|
||||
default = "::1";
|
||||
description = "Address to listen on for connections by the reverse proxy/tls terminator.";
|
||||
};
|
||||
global.database_path = mkOption {
|
||||
type = types.str;
|
||||
default = cfg.dataDir;
|
||||
readOnly = true;
|
||||
description = ''
|
||||
Path to the conduit database, the directory where conduit will save its data.
|
||||
Note that due to using the DynamicUser feature of systemd, this value should not be changed
|
||||
and is set to be read only.
|
||||
'';
|
||||
};
|
||||
global.database_backend = mkOption {
|
||||
type = types.enum [ "sqlite" "rocksdb" ];
|
||||
default = "sqlite";
|
||||
example = "rocksdb";
|
||||
description = ''
|
||||
The database backend for the service. Switching it on an existing
|
||||
instance will require manual migration of data.
|
||||
'';
|
||||
};
|
||||
global.allow_check_for_updates = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to allow Conduit to automatically contact
|
||||
<https://conduit.rs> hourly to check for important Conduit news.
|
||||
|
||||
Disabled by default because nixpkgs handles updates.
|
||||
'';
|
||||
};
|
||||
Disabled by default because nixpkgs handles updates.
|
||||
'';
|
||||
};
|
||||
};
|
||||
default = {};
|
||||
description = ''
|
||||
Generates the conduit.toml configuration file. Refer to
|
||||
<https://docs.conduit.rs/configuration.html>
|
||||
for details on supported values.
|
||||
Note that database_path can not be edited because the service's reliance on systemd StateDir.
|
||||
'';
|
||||
};
|
||||
default = { };
|
||||
description = ''
|
||||
Generates the conduit.toml configuration file. Refer to
|
||||
<https://docs.conduit.rs/configuration.html>
|
||||
for details on supported values.
|
||||
Note that database_path can not be edited because the service's reliance on systemd StateDir.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
users.users.conduit = {
|
||||
group = "conduit";
|
||||
isSystemUser = true;
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
users.users.conduit = {
|
||||
users.groups.conduit = { };
|
||||
|
||||
systemd.tmpfiles.settings."10-conduit" = {
|
||||
${cfg.dataDir}.d = {
|
||||
user = "conduit";
|
||||
group = "conduit";
|
||||
isSystemUser = true;
|
||||
};
|
||||
|
||||
users.groups.conduit = {};
|
||||
|
||||
systemd.tmpfiles.settings."10-conduit" = {
|
||||
${cfg.dataDir}.d = {
|
||||
user = "conduit";
|
||||
group = "conduit";
|
||||
mode = "0700";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.conduit = {
|
||||
description = "Conduit Matrix Server";
|
||||
documentation = [ "https://gitlab.com/famedly/conduit/" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
environment = lib.mkMerge ([
|
||||
{ CONDUIT_CONFIG = configFile; }
|
||||
cfg.extraEnvironment
|
||||
]);
|
||||
serviceConfig = {
|
||||
User = "conduit";
|
||||
Group = "conduit";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateUsers = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
];
|
||||
WorkingDirectory = cfg.dataDir;
|
||||
ReadWritePaths = cfg.dataDir;
|
||||
ExecStart = lib.getExe' cfg.package "conduit";
|
||||
Restart = "on-failure";
|
||||
RestartSec = 10;
|
||||
StartLimitBurst = 5;
|
||||
UMask = "077";
|
||||
};
|
||||
mode = "0700";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
systemd.services.conduit = {
|
||||
description = "Conduit Matrix Server";
|
||||
documentation = [ "https://gitlab.com/famedly/conduit/" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
environment = lib.mkMerge ([
|
||||
{ CONDUIT_CONFIG = configFile; }
|
||||
cfg.extraEnvironment
|
||||
]);
|
||||
serviceConfig = {
|
||||
User = "conduit";
|
||||
Group = "conduit";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateUsers = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
];
|
||||
WorkingDirectory = cfg.dataDir;
|
||||
ReadWritePaths = cfg.dataDir;
|
||||
ExecStart = lib.getExe' cfg.package "conduit";
|
||||
Restart = "on-failure";
|
||||
RestartSec = 10;
|
||||
StartLimitBurst = 5;
|
||||
UMask = "077";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -77,7 +77,7 @@ in
|
|||
ExecStart = "${cfg.package}/bin/jellyfin --datadir '${cfg.dataDir}' --cachedir '${cfg.cacheDir}' --logdir '${cfg.logDir}'";
|
||||
Restart = "on-failure";
|
||||
TimeoutSec = 15;
|
||||
SuccessExitStatus = ["0" "143"];
|
||||
SuccessExitStatus = [ "0" "143" ];
|
||||
|
||||
# Security options:
|
||||
NoNewPrivileges = true;
|
||||
|
|
@ -128,7 +128,7 @@ in
|
|||
};
|
||||
|
||||
users.groups = mkIf (cfg.group == "jellyfin") {
|
||||
jellyfin = {};
|
||||
jellyfin = { };
|
||||
};
|
||||
|
||||
networking.firewall = mkIf cfg.openFirewall {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue