emily/nixfiles
emily/nixfiles
1
0
Fork 0
Code Issues Pull requests Activity

ooklaserver: Cleanup

Browse source
This commit is contained in:
emily 2024-09-12 00:15:52 +02:00
parent 66bfeade06
commit e56c756223
Signed by: emily
GPG key ID: F6F4C66207FCF995
1 changed files with 25 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
modules/ooklaserver/default.nix
View file

@ -3,13 +3,15 @@ let
cfg = config.kyouma.ooklaserver; cfg = config.kyouma.ooklaserver;
in { in {
options = { options = {
kyouma.ooklaserver = with lib; { kyouma.ooklaserver = let
enable = mkEnableOption "ookla speedtest server"; inherit (lib) mkOption types;
package = mkPackageOption pkgs "ooklaserver" {}; in {
enable = lib.mkEnableOption "ookla speedtest server";
package = lib.mkPackageOption pkgs "ooklaserver" {};
domain = mkOption { domain = mkOption {
description = "Domain to use."; description = "Domain to use.";
default = null; default = null;
type = types.str; type = with types; nullOr nonEmptyStr;
}; };
openFirewall = mkOption { openFirewall = mkOption {
description = "Whether to open the firewall for the specified ports."; description = "Whether to open the firewall for the specified ports.";
@ -51,20 +53,19 @@ in {
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
users.users.ooklaserver = {
description = "OoklaServer User";
group = "ooklaserver";
createHome = false;
isSystemUser = true;
};
users.groups.ooklaserver = {};
security.acme.certs.${cfg.domain} = { security.acme.certs.${cfg.domain} = {
group = "ooklaserver";
reloadServices = [ "ooklaserver.service" ]; reloadServices = [ "ooklaserver.service" ];
webroot = "/var/lib/acme/acme-challenge"; webroot = "/var/lib/acme/acme-challenge";
}; };
kyouma.ooklaserver.settings = with lib; { networking.firewall = lib.mkIf cfg.openFirewall {
allowedUDPPorts = cfg.udpPorts;
allowedTCPPorts = cfg.tcpPorts;
};
kyouma.ooklaserver.settings = let
inherit (lib) mkDefault;
in {
OoklaServer = { OoklaServer = {
inherit (cfg) tcpPorts udpPorts; inherit (cfg) tcpPorts udpPorts;
enableAutoUpdate = false; enableAutoUpdate = false;
@ -89,8 +90,8 @@ in {
http.maxHeadersSize = mkDefault 65536; http.maxHeadersSize = mkDefault 65536;
}; };
openSSL.server = { openSSL.server = {
certificateFile = "${config.security.acme.certs.${cfg.domain}.directory}/cert.pem"; certificateFile = "/run/credentials/${config.systemd.services.ooklaserver.name}/cert.pem";
privateKeyFile = "${config.security.acme.certs.${cfg.domain}.directory}/key.pem"; privateKeyFile = "/run/credentials/${config.systemd.services.ooklaserver.name}/key.pem";
minimumTLSProtocol = mkDefault "1.2"; minimumTLSProtocol = mkDefault "1.2";
}; };
logging.loggers.app = { logging.loggers.app = {
@ -102,10 +103,7 @@ in {
level = mkDefault "information"; level = mkDefault "information";
}; };
}; };
networking.firewall = lib.mkIf cfg.openFirewall {
allowedUDPPorts = cfg.udpPorts;
allowedTCPPorts = cfg.tcpPorts;
};
systemd.services.ooklaserver = let systemd.services.ooklaserver = let
configFile = let configFile = let
anyToString = arg: if (lib.isBool arg) then anyToString = arg: if (lib.isBool arg) then
@ -113,8 +111,8 @@ in {
else if (lib.isList arg) then else if (lib.isList arg) then
lib.concatStringsSep "," (map (val: toString val) arg) lib.concatStringsSep "," (map (val: toString val) arg)
else toString arg; else toString arg;
in
in with lib; lib.pipe cfg.settings [ with lib; lib.pipe cfg.settings [
(mapAttrsRecursive (path: val: "${concatStringsSep "." path} = ${anyToString val}")) (mapAttrsRecursive (path: val: "${concatStringsSep "." path} = ${anyToString val}"))
(collect isString) (collect isString)
(concatLines) (concatLines)
@ -132,9 +130,15 @@ in {
serviceConfig = { serviceConfig = {
Type = "simple"; Type = "simple";
Restart = "always"; Restart = "always";
User = "ooklaserver"; User = "ooklaserver";
Group = "ooklaserver"; Group = "ooklaserver";
DynamicUser = true;
LoadCredential = [
"cert.pem:${config.security.acme.certs.${cfg.domain}.directory}/cert.pem"
"key.pem:${config.security.acme.certs.${cfg.domain}.directory}/key.pem"
];
ExecStart = "${packageWithCfg}/bin/OoklaServer"; ExecStart = "${packageWithCfg}/bin/OoklaServer";
WorkingDirectory = packageWithCfg; WorkingDirectory = packageWithCfg;
SyslogIdentifier = "ooklaserver"; SyslogIdentifier = "ooklaserver";