Compare commits

..

2 Commits

Author SHA1 Message Date
tux
b93b8adcc8 feat: update trok flake input url 2025-06-24 22:31:08 +05:30
tux
4d6e80e4bc feat: remove trok module 2025-06-24 22:18:04 +05:30
4 changed files with 10 additions and 107 deletions

18
flake.lock generated
View File

@ -1672,17 +1672,17 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1741607494, "lastModified": 1750784325,
"narHash": "sha256-d6H+zTm0g1loLBQOoesyLKFRAIDzdR7zPpO7fU/hSCY=", "narHash": "sha256-7JsHpnDubs9fSNhDI8XC/1XMPK/ls6U4AVHc7HKzoMs=",
"ref": "refs/heads/main", "owner": "tuxdotrs",
"rev": "05c9e912c47d8c67ce86a3cf92d8581dabf9dcb8", "repo": "trok",
"revCount": 31, "rev": "071c6711274c9dda6e4f6c0dbaad827ad9b150f1",
"type": "git", "type": "github"
"url": "ssh://git@github.com/tuxdotrs/trok.git"
}, },
"original": { "original": {
"type": "git", "owner": "tuxdotrs",
"url": "ssh://git@github.com/tuxdotrs/trok.git" "repo": "trok",
"type": "github"
} }
}, },
"utils": { "utils": {

View File

@ -134,7 +134,7 @@
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
trok = { trok = {
url = "git+ssh://git@github.com/tuxdotrs/trok.git"; url = "github:tuxdotrs/trok";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
tpanel = { tpanel = {

View File

@ -16,7 +16,6 @@
../../modules/nixos/selfhosted/tfolio.nix ../../modules/nixos/selfhosted/tfolio.nix
../../modules/nixos/selfhosted/cyber-tux.nix ../../modules/nixos/selfhosted/cyber-tux.nix
../../modules/nixos/networking/ssh.nix ../../modules/nixos/networking/ssh.nix
../../modules/nixos/selfhosted/trok.nix
]; ];
sops.secrets.tux-password = { sops.secrets.tux-password = {

View File

@ -1,96 +0,0 @@
{
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.tux.services.trok;
in {
options.tux.services.trok = {
enable = mkEnableOption "Enable trok";
host = mkOption {
type = lib.types.str;
default = "0.0.0.0";
description = "Host addr on which the trok service will listen.";
};
port = mkOption {
type = lib.types.port;
default = 1337;
description = "Port number on which the trok service will listen.";
};
openFirewall = mkEnableOption "Enable firewall port";
user = mkOption {
type = types.str;
default = "trok";
description = "User under which the trok service runs.";
};
group = mkOption {
type = types.str;
default = "trok";
description = "Group under which the trok service runs.";
};
};
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [cfg.port];
systemd.services = {
trok = {
description = "trok server";
after = ["network.target"];
wantedBy = ["multi-user.target"];
serviceConfig = {
Type = "simple";
User = "trok";
Group = "trok";
ExecStart = "${getExe pkgs.trok} server -a ${cfg.host}:${toString cfg.port}";
Restart = "always";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateIPC = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RestrictNamespaces = "uts ipc pid user cgroup";
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = ["@system-service"];
UMask = "0077";
};
};
};
# Ensure the user and group exist
users.users = mkIf (cfg.user == "trok") {
${cfg.user} = {
isSystemUser = true;
group = cfg.group;
description = "trok service user";
home = "/var/lib/trok";
createHome = true;
};
};
users.groups = mkIf (cfg.group == "trok") {
${cfg.group} = {};
};
};
}