99 lines
2.4 KiB
Nix
99 lines
2.4 KiB
Nix
{self}: {
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
cfg = config.services.azess;
|
|
inherit (lib) mkEnableOption mkIf mkOption types;
|
|
|
|
defaultPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
|
|
gunicornArgs =
|
|
[
|
|
"--workers"
|
|
(toString cfg.workers)
|
|
"--bind"
|
|
"${cfg.host}:${toString cfg.port}"
|
|
]
|
|
++ cfg.extraArgs;
|
|
in {
|
|
options.services.azess = {
|
|
enable = mkEnableOption "AZess Flask/Gunicorn web application";
|
|
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = defaultPackage;
|
|
defaultText = "self.packages.\${pkgs.stdenv.hostPlatform.system}.default";
|
|
description = "AZess package to run.";
|
|
};
|
|
|
|
host = mkOption {
|
|
type = types.str;
|
|
default = "127.0.0.1";
|
|
description = "Host/IP address Gunicorn binds to.";
|
|
};
|
|
|
|
port = mkOption {
|
|
type = types.port;
|
|
default = 8000;
|
|
description = "TCP port Gunicorn binds to.";
|
|
};
|
|
|
|
workers = mkOption {
|
|
type = types.ints.positive;
|
|
default = 4;
|
|
description = "Number of Gunicorn worker processes.";
|
|
};
|
|
|
|
openFirewall = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Open the configured TCP port in the local firewall.";
|
|
};
|
|
|
|
extraArgs = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
description = "Additional arguments passed to Gunicorn before app:app.";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
users.groups.azess = {};
|
|
users.users.azess = {
|
|
isSystemUser = true;
|
|
group = "azess";
|
|
description = "AZess service user";
|
|
};
|
|
|
|
systemd.services.azess = {
|
|
description = "AZess Active Directory user setup application";
|
|
wantedBy = ["multi-user.target"];
|
|
after = ["network.target"];
|
|
|
|
environment = {
|
|
XDG_CACHE_HOME = "/var/cache/azess";
|
|
};
|
|
|
|
serviceConfig = {
|
|
ExecStart = "${lib.getExe cfg.package} ${lib.escapeShellArgs gunicornArgs}";
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
|
|
User = "azess";
|
|
Group = "azess";
|
|
CacheDirectory = "azess";
|
|
RuntimeDirectory = "azess";
|
|
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectHome = true;
|
|
ProtectSystem = "strict";
|
|
RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [cfg.port];
|
|
};
|
|
}
|