feat: add cyber-tux module

2026-06-17 10:16:31 +05:30 · 2026-05-09 04:54:32 +05:30
parent 96841dbfa8
commit a9d91df8ce
5 changed files with 141 additions and 1 deletions
--- a/modules/nixos/services/cyber-tux.nix
+++ b/modules/nixos/services/cyber-tux.nix
@@ -0,0 +1,105 @@
+{
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.cyber-tux;
+    in
+    {
+      options.tnix.services.cyber-tux = {
+        enable = mkEnableOption "CyberTux Discord bot";
+
+        user = mkOption {
+          type = types.str;
+          default = "cyber-tux";
+          description = "User under which the CyberTux service runs.";
+        };
+
+        group = mkOption {
+          type = types.str;
+          default = "cyber-tux";
+          description = "Group under which the CyberTux service runs.";
+        };
+
+        dataDir = mkOption {
+          type = types.path;
+          default = "/var/lib/cyber-tux";
+          description = "Directory where CyberTux stores its data.";
+        };
+
+        environmentFile = mkOption {
+          type = types.path;
+          description = "Environment file containing the Discord bot token.";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        systemd.services.cyber-tux = {
+          description = "CyberTux Discord bot";
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+
+          serviceConfig = {
+            Type = "simple";
+            User = cfg.user;
+            Group = cfg.group;
+            EnvironmentFile = cfg.environmentFile;
+            ExecStart = getExe pkgs.cyber-tux;
+            Restart = "always";
+            RestartSec = 5;
+            WorkingDirectory = cfg.dataDir;
+            StateDirectory = baseNameOf cfg.dataDir;
+            StateDirectoryMode = "0700";
+
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            NoNewPrivileges = true;
+            PrivateDevices = true;
+            PrivateIPC = true;
+            PrivateTmp = true;
+            PrivateUsers = true;
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            ProtectSystem = "strict";
+            RestrictNamespaces = [
+              "uts"
+              "ipc"
+              "pid"
+              "user"
+              "cgroup"
+            ];
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [ "@system-service" ];
+            UMask = "0077";
+          };
+        };
+
+        users.users = mkIf (cfg.user == "cyber-tux") {
+          ${cfg.user} = {
+            isSystemUser = true;
+            group = cfg.group;
+            description = "CyberTux service user";
+            home = cfg.dataDir;
+            createHome = true;
+          };
+        };
+
+        users.groups = mkIf (cfg.group == "cyber-tux") {
+          ${cfg.group} = { };
+        };
+      };
+    };
+}