mirror of
https://github.com/tuxdotrs/nixos-config.git
synced 2025-07-06 09:46:34 +05:30
Compare commits
2 Commits
997a0eba85
...
b93b8adcc8
Author | SHA1 | Date | |
---|---|---|---|
b93b8adcc8
|
|||
4d6e80e4bc
|
18
flake.lock
generated
18
flake.lock
generated
@ -1672,17 +1672,17 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1741607494,
|
"lastModified": 1750784325,
|
||||||
"narHash": "sha256-d6H+zTm0g1loLBQOoesyLKFRAIDzdR7zPpO7fU/hSCY=",
|
"narHash": "sha256-7JsHpnDubs9fSNhDI8XC/1XMPK/ls6U4AVHc7HKzoMs=",
|
||||||
"ref": "refs/heads/main",
|
"owner": "tuxdotrs",
|
||||||
"rev": "05c9e912c47d8c67ce86a3cf92d8581dabf9dcb8",
|
"repo": "trok",
|
||||||
"revCount": 31,
|
"rev": "071c6711274c9dda6e4f6c0dbaad827ad9b150f1",
|
||||||
"type": "git",
|
"type": "github"
|
||||||
"url": "ssh://git@github.com/tuxdotrs/trok.git"
|
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"type": "git",
|
"owner": "tuxdotrs",
|
||||||
"url": "ssh://git@github.com/tuxdotrs/trok.git"
|
"repo": "trok",
|
||||||
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"utils": {
|
"utils": {
|
||||||
|
@ -134,7 +134,7 @@
|
|||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
trok = {
|
trok = {
|
||||||
url = "git+ssh://git@github.com/tuxdotrs/trok.git";
|
url = "github:tuxdotrs/trok";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
tpanel = {
|
tpanel = {
|
||||||
|
@ -16,7 +16,6 @@
|
|||||||
../../modules/nixos/selfhosted/tfolio.nix
|
../../modules/nixos/selfhosted/tfolio.nix
|
||||||
../../modules/nixos/selfhosted/cyber-tux.nix
|
../../modules/nixos/selfhosted/cyber-tux.nix
|
||||||
../../modules/nixos/networking/ssh.nix
|
../../modules/nixos/networking/ssh.nix
|
||||||
../../modules/nixos/selfhosted/trok.nix
|
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.secrets.tux-password = {
|
sops.secrets.tux-password = {
|
||||||
|
@ -1,96 +0,0 @@
|
|||||||
{
|
|
||||||
config,
|
|
||||||
lib,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
with lib; let
|
|
||||||
cfg = config.tux.services.trok;
|
|
||||||
in {
|
|
||||||
options.tux.services.trok = {
|
|
||||||
enable = mkEnableOption "Enable trok";
|
|
||||||
|
|
||||||
host = mkOption {
|
|
||||||
type = lib.types.str;
|
|
||||||
default = "0.0.0.0";
|
|
||||||
description = "Host addr on which the trok service will listen.";
|
|
||||||
};
|
|
||||||
|
|
||||||
port = mkOption {
|
|
||||||
type = lib.types.port;
|
|
||||||
default = 1337;
|
|
||||||
description = "Port number on which the trok service will listen.";
|
|
||||||
};
|
|
||||||
|
|
||||||
openFirewall = mkEnableOption "Enable firewall port";
|
|
||||||
|
|
||||||
user = mkOption {
|
|
||||||
type = types.str;
|
|
||||||
default = "trok";
|
|
||||||
description = "User under which the trok service runs.";
|
|
||||||
};
|
|
||||||
|
|
||||||
group = mkOption {
|
|
||||||
type = types.str;
|
|
||||||
default = "trok";
|
|
||||||
description = "Group under which the trok service runs.";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
|
||||||
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [cfg.port];
|
|
||||||
|
|
||||||
systemd.services = {
|
|
||||||
trok = {
|
|
||||||
description = "trok server";
|
|
||||||
after = ["network.target"];
|
|
||||||
wantedBy = ["multi-user.target"];
|
|
||||||
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "simple";
|
|
||||||
User = "trok";
|
|
||||||
Group = "trok";
|
|
||||||
ExecStart = "${getExe pkgs.trok} server -a ${cfg.host}:${toString cfg.port}";
|
|
||||||
Restart = "always";
|
|
||||||
|
|
||||||
LockPersonality = true;
|
|
||||||
MemoryDenyWriteExecute = true;
|
|
||||||
NoNewPrivileges = true;
|
|
||||||
PrivateDevices = true;
|
|
||||||
PrivateIPC = true;
|
|
||||||
PrivateTmp = true;
|
|
||||||
PrivateUsers = true;
|
|
||||||
ProtectClock = true;
|
|
||||||
ProtectControlGroups = true;
|
|
||||||
ProtectHome = true;
|
|
||||||
ProtectHostname = true;
|
|
||||||
ProtectKernelLogs = true;
|
|
||||||
ProtectKernelModules = true;
|
|
||||||
ProtectKernelTunables = true;
|
|
||||||
ProtectProc = "invisible";
|
|
||||||
ProtectSystem = "strict";
|
|
||||||
RestrictNamespaces = "uts ipc pid user cgroup";
|
|
||||||
RestrictRealtime = true;
|
|
||||||
RestrictSUIDSGID = true;
|
|
||||||
SystemCallArchitectures = "native";
|
|
||||||
SystemCallFilter = ["@system-service"];
|
|
||||||
UMask = "0077";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
# Ensure the user and group exist
|
|
||||||
users.users = mkIf (cfg.user == "trok") {
|
|
||||||
${cfg.user} = {
|
|
||||||
isSystemUser = true;
|
|
||||||
group = cfg.group;
|
|
||||||
description = "trok service user";
|
|
||||||
home = "/var/lib/trok";
|
|
||||||
createHome = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
users.groups = mkIf (cfg.group == "trok") {
|
|
||||||
${cfg.group} = {};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
Reference in New Issue
Block a user