feat: add tfolio

flake.lock

@@ -713,6 +713,7 @@
         "nixpkgs-stable": "nixpkgs-stable_3",
         "nur": "nur",
         "sops-nix": "sops-nix",
+        "tfolio": "tfolio",
         "wezterm-flake": "wezterm-flake"
       }
     },
@@ -832,6 +833,26 @@
         "type": "github"
       }
     },
+    "tfolio": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1740197906,
+        "narHash": "sha256-G4H/c91GlHhUG7joDXxmvtcWz1xepzwRR4J+gQGLH+k=",
+        "ref": "refs/heads/main",
+        "rev": "23cf45aa50e8db9533d8ca432bcd7b4d2bc2b421",
+        "revCount": 13,
+        "type": "git",
+        "url": "ssh://git@github.com/tuxdotrs/tfolio.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@github.com/tuxdotrs/tfolio.git"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -90,6 +90,10 @@
       url = "git+ssh://git@github.com/tuxdotrs/nix-secrets.git?shallow=1";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    tfolio = {
+      url = "git+ssh://git@github.com/tuxdotrs/tfolio.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     cyber-tux = {
       url = "git+ssh://git@github.com/tuxdotrs/cyber-tux.git";
       inputs.nixpkgs.follows = "nixpkgs";

hosts/alpha/default.nix

@@ -15,6 +15,8 @@
   tux.services.openssh.enable = true;
   tux.services.openssh.ports = [23];
 
+  tux.services.tfolio.enable = true;
+
   sops.secrets = {
     borg_encryption_key = {
       sopsFile = ./secrets.yaml;

hosts/common/default.nix

@@ -14,6 +14,7 @@
     ../../modules/nixos/fail2ban.nix
     ../../modules/nixos/sops.nix
     ../../modules/nixos/upstream-proxy.nix
+    ../../modules/nixos/tfolio.nix
     ../../modules/nixos/cyber-tux.nix
     ../../modules/nixos/networking/ssh.nix
   ];

modules/nixos/tfolio.nix

@@ -0,0 +1,102 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.tux.services.tfolio;
+in {
+  options.tux.services.tfolio = {
+    enable = mkEnableOption "Enable tfolio";
+
+    host = mkOption {
+      type = lib.types.str;
+      default = "0.0.0.0";
+      description = "";
+    };
+
+    port = mkOption {
+      type = lib.types.port;
+      default = 22;
+      description = "";
+    };
+
+    dataDir = mkOption {
+      type = lib.types.str;
+      default = "/var/lib/tfolio/";
+      description = "";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "tfolio";
+      description = "User under which the tfolio service runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "tfolio";
+      description = "Group under which the tfolio service runs.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services = {
+      tfolio = {
+        description = "my portfolio in a ssh session";
+        after = ["network.target"];
+        wantedBy = ["multi-user.target"];
+
+        serviceConfig = {
+          Type = "simple";
+          User = cfg.user;
+          Group = cfg.group;
+          ExecStart = "${getExe pkgs.tfolio} -l ${cfg.host} -p ${toString cfg.port} -d ${cfg.dataDir}";
+          Restart = "always";
+          StateDirectory = "tfolio";
+
+          # Allow binding to privileged ports
+          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+          CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
+
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateIPC = true;
+          PrivateTmp = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = "read-only";
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "full";
+          RestrictNamespaces = "uts ipc pid user cgroup";
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = ["@system-service"];
+          UMask = "0077";
+        };
+      };
+    };
+    # Ensure the user and group exist
+    users.users = mkIf (cfg.user == "tfolio") {
+      ${cfg.user} = {
+        isSystemUser = true;
+        group = cfg.group;
+        description = "tfolio service user";
+        home = "/var/lib/tfolio";
+        createHome = true;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "tfolio") {
+      ${cfg.group} = {};
+    };
+  };
+}

overlays/default.nix

@@ -4,6 +4,7 @@
   modifications = final: prev: {
     awesome = inputs.nixpkgs-f2k.packages.${prev.system}.awesome-git;
     ghostty = inputs.ghostty.packages.${prev.system}.default;
+    tfolio = inputs.tfolio.packages.${prev.system}.default;
     cyber-tux = inputs.cyber-tux.packages.${prev.system}.default;
     discord = prev.discord.override {
       withOpenASAR = true;