refactor(services): standardize service module options

modules/nixos/services/aiostreams.nix

@@ -8,19 +8,29 @@
     with lib;
     let
       cfg = config.tnix.services.aiostreams;
+      port = toString cfg.port;
+      acmeHost = config.tnix.services.nginx.domain;
     in
     {
       options.tnix.services.aiostreams = {
-        enable = mkEnableOption "Enable AIOStreams";
+        enable = mkEnableOption "AIOStreams";
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = 3000;
+          description = "Port on which AIOStreams listens";
         };
 
         domain = mkOption {
           type = types.str;
           default = "";
+          description = "Domain on which nginx serves AIOStreams (disabled when empty)";
+        };
+
+        image = mkOption {
+          type = types.str;
+          default = "ghcr.io/viren070/aiostreams:latest";
+          description = "Container image to use";
         };
 
         dataDir = mkOption {
@@ -30,33 +40,33 @@
         };
 
         environmentFile = mkOption {
-          type = with types; path;
-          default = "";
+          type = types.nullOr types.path;
+          default = null;
+          description = "Environment file with secrets passed to the container";
         };
       };
 
       config = mkIf cfg.enable {
         virtualisation.oci-containers.containers.aiostreams = {
-          autoStart = true;
-          image = "ghcr.io/viren070/aiostreams:latest";
+          image = cfg.image;
           ports = [
-            "${toString cfg.port}:3000"
+            "127.0.0.1:${port}:3000"
           ];
           environment = {
-            ADDON_ID = "${cfg.domain}";
+            ADDON_ID = cfg.domain;
             BASE_URL = "https://${cfg.domain}";
           };
-          environmentFiles = [ cfg.environmentFile ];
+          environmentFiles = optional (cfg.environmentFile != null) cfg.environmentFile;
           volumes = [
             "${cfg.dataDir}:/app/data"
           ];
         };
 
-        services.nginx.virtualHosts.${cfg.domain} = {
-          forceSSL = true;
-          useACMEHost = config.tnix.services.nginx.domain;
+        services.nginx.virtualHosts.${cfg.domain} = mkIf (cfg.domain != "") {
+          forceSSL = acmeHost != "";
+          useACMEHost = mkIf (acmeHost != "") acmeHost;
           locations."/" = {
-            proxyPass = "http://localhost:${toString cfg.port}";
+            proxyPass = "http://127.0.0.1:${port}";
           };
         };
       };

modules/nixos/services/cyber-tux.nix

@@ -29,7 +29,7 @@
         dataDir = mkOption {
           type = types.path;
           default = "/var/lib/cyber-tux";
-          description = "Directory where CyberTux stores its data.";
+          description = "Directory where CyberTux stores its data (must be under /var/lib).";
         };
 
         environmentFile = mkOption {
@@ -41,7 +41,8 @@
       config = mkIf cfg.enable {
         systemd.services.cyber-tux = {
           description = "CyberTux Discord bot";
-          after = [ "network.target" ];
+          after = [ "network-online.target" ];
+          wants = [ "network-online.target" ];
           wantedBy = [ "multi-user.target" ];
 
           serviceConfig = {

modules/nixos/services/mediaflow-proxy.nix

@@ -8,46 +8,56 @@
     with lib;
     let
       cfg = config.tnix.services.mediaflow-proxy;
+      port = toString cfg.port;
+      acmeHost = config.tnix.services.nginx.domain;
     in
     {
       options.tnix.services.mediaflow-proxy = {
-        enable = mkEnableOption "Enable MediaFlow Proxy";
+        enable = mkEnableOption "MediaFlow Proxy";
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = 8888;
+          description = "Port on which MediaFlow Proxy listens";
         };
 
         domain = mkOption {
           type = types.str;
           default = "";
+          description = "Domain on which nginx serves MediaFlow Proxy (disabled when empty)";
+        };
+
+        image = mkOption {
+          type = types.str;
+          default = "ghcr.io/mhdzumair/mediaflow-proxy-light:latest";
+          description = "Container image to use";
         };
 
         environmentFile = mkOption {
-          type = with types; path;
-          default = "";
+          type = types.nullOr types.path;
+          default = null;
+          description = "Environment file with secrets passed to the container";
         };
       };
 
       config = mkIf cfg.enable {
         virtualisation.oci-containers.containers.mediaflow-proxy = {
-          autoStart = true;
-          image = "ghcr.io/mhdzumair/mediaflow-proxy-light:latest";
+          image = cfg.image;
           ports = [
-            "${toString cfg.port}:8888"
+            "${port}:${port}"
           ];
           environment = {
             APP__SERVER__HOST = "0.0.0.0";
-            APP__SERVER__PORT = "${toString cfg.port}";
+            APP__SERVER__PORT = port;
           };
-          environmentFiles = [ cfg.environmentFile ];
+          environmentFiles = optional (cfg.environmentFile != null) cfg.environmentFile;
         };
 
-        services.nginx.virtualHosts.${cfg.domain} = {
-          forceSSL = true;
-          useACMEHost = config.tnix.services.nginx.domain;
+        services.nginx.virtualHosts.${cfg.domain} = mkIf (cfg.domain != "") {
+          forceSSL = acmeHost != "";
+          useACMEHost = mkIf (acmeHost != "") acmeHost;
           locations."/" = {
-            proxyPass = "http://localhost:${toString cfg.port}";
+            proxyPass = "http://127.0.0.1:${port}";
             proxyWebsockets = true;
           };
         };

modules/nixos/services/nginx.nix

@@ -12,11 +12,12 @@
     in
     {
       options.tnix.services.nginx = {
-        enable = mkEnableOption "Enable Nginx";
+        enable = mkEnableOption "Nginx";
 
         domain = mkOption {
           type = types.str;
           default = "";
+          description = "Base domain for the wildcard ACME certificate (disabled when empty)";
         };
       };
 
@@ -24,8 +25,8 @@
         security = {
           acme = {
             acceptTerms = true;
-            defaults.email = "${userEmail}";
-            certs = {
+            defaults.email = userEmail;
+            certs = mkIf (cfg.domain != "") {
               "${cfg.domain}" = {
                 group = "nginx";
                 domain = "*.${cfg.domain}";

modules/nixos/services/vaultwarden.nix

@@ -8,19 +8,23 @@
     with lib;
     let
       cfg = config.tnix.services.vaultwarden;
+      port = toString cfg.port;
+      acmeHost = config.tnix.services.nginx.domain;
     in
     {
       options.tnix.services.vaultwarden = {
-        enable = mkEnableOption "Enable Vaultwarden";
+        enable = mkEnableOption "Vaultwarden";
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = 8000;
+          description = "Port on which Vaultwarden listens";
         };
 
         domain = mkOption {
           type = types.str;
           default = "";
+          description = "Domain on which nginx serves Vaultwarden (disabled when empty)";
         };
       };
 
@@ -41,11 +45,11 @@
             };
           };
 
-          nginx.virtualHosts.${cfg.domain} = {
-            forceSSL = true;
-            useACMEHost = config.tnix.services.nginx.domain;
+          nginx.virtualHosts.${cfg.domain} = mkIf (cfg.domain != "") {
+            forceSSL = acmeHost != "";
+            useACMEHost = mkIf (acmeHost != "") acmeHost;
             locations."/" = {
-              proxyPass = "http://localhost:${toString cfg.port}";
+              proxyPass = "http://127.0.0.1:${port}";
               proxyWebsockets = true;
             };
           };