chore: the nix stuff

2026-07-09 07:43:50 +02:00
parent f769d78a14
commit 3a745690a5
4 changed files with 219 additions and 0 deletions
@@ -0,0 +1,98 @@
+{self}: {
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.services.azess;
+  inherit (lib) mkEnableOption mkIf mkOption types;
+
+  defaultPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
+  gunicornArgs =
+    [
+      "--workers"
+      (toString cfg.workers)
+      "--bind"
+      "${cfg.host}:${toString cfg.port}"
+    ]
+    ++ cfg.extraArgs;
+in {
+  options.services.azess = {
+    enable = mkEnableOption "AZess Flask/Gunicorn web application";
+
+    package = mkOption {
+      type = types.package;
+      default = defaultPackage;
+      defaultText = "self.packages.\${pkgs.stdenv.hostPlatform.system}.default";
+      description = "AZess package to run.";
+    };
+
+    host = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = "Host/IP address Gunicorn binds to.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8000;
+      description = "TCP port Gunicorn binds to.";
+    };
+
+    workers = mkOption {
+      type = types.ints.positive;
+      default = 4;
+      description = "Number of Gunicorn worker processes.";
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Open the configured TCP port in the local firewall.";
+    };
+
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = "Additional arguments passed to Gunicorn before app:app.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.groups.azess = {};
+    users.users.azess = {
+      isSystemUser = true;
+      group = "azess";
+      description = "AZess service user";
+    };
+
+    systemd.services.azess = {
+      description = "AZess Active Directory user setup application";
+      wantedBy = ["multi-user.target"];
+      after = ["network.target"];
+
+      environment = {
+        XDG_CACHE_HOME = "/var/cache/azess";
+      };
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} ${lib.escapeShellArgs gunicornArgs}";
+        Restart = "on-failure";
+        RestartSec = "5s";
+
+        User = "azess";
+        Group = "azess";
+        CacheDirectory = "azess";
+        RuntimeDirectory = "azess";
+
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectHome = true;
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [cfg.port];
+  };
+}