nix module

flake.nix

@@ -10,5 +10,21 @@
       inputs.flakelight.follows = "flakelight";
     };
   };
-  outputs = { mill-scale, ... }: mill-scale ./. { };
+  outputs = {mill-scale, ...}:
+    mill-scale ./. {
+      nixosModules = {outputs, ...}: {
+        default = {
+          pkgs,
+          config,
+          lib,
+          ...
+        }: {
+          imports = [./nix/module.nix];
+          config = lib.mkIf config.services.demostf.sync.enable {
+            nixpkgs.overlays = [outputs.overlays.default];
+            services.demostf.sync.package = lib.mkDefault pkgs.demostf-sync;
+          };
+        };
+      };
+    };
 }

nix/docker.nix

@@ -1,6 +1,6 @@
-{ dockerTools
+{
-, demostf-sync
+  dockerTools,
-,
+  demostf-sync,
 }:
 dockerTools.buildLayeredImage {
   name = "demostf/sync";

nix/module.nix

@@ -0,0 +1,64 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.services.demostf.sync;
+in {
+  options = {
+    services.demostf.sync = with lib; {
+      enable = mkEnableOption "demostf sync";
+      package = mkOption {
+        type = types.package;
+        defaultText = literalExpression "pkgs.demostf-sync";
+        description = "package to use";
+      };
+      socket = mkOption {
+        type = types.str;
+        default = "/var/run/demostf-sync/sync.socket";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.demostf-sync = {
+      wantedBy = ["multi-user.target"];
+      environment = {
+        SOCKET = cfg.socket;
+      };
+
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = "${cfg.package}/bin/sync";
+        Restart = "on-failure";
+
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        CapabilityBoundingSet = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        SystemCallArchitectures = "native";
+        ProtectKernelModules = true;
+        RestrictNamespaces = true;
+        MemoryDenyWriteExecute = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        ProtectKernelTunables = true;
+        DevicePolicy = "closed";
+        RestrictAddressFamilies = ["AF_UNIX"];
+        RestrictRealtime = true;
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+        SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];
+        UMask = "0007";
+        IPAddressDeny = "any";
+        RuntimeDirectory = "demostf-sync";
+      };
+    };
+  };
+}

nix/package.nix

@@ -1,11 +1,10 @@
-{ stdenv
+{
-, rustPlatform
+  stdenv,
-, lib
+  rustPlatform,
-, pkg-config
+  lib,
-, openssl
+  pkg-config,
-,
+  openssl,
-}:
+}: let
-let
   inherit (lib.sources) sourceByRegex;
   inherit (builtins) fromTOML readFile;
   src = sourceByRegex ../. ["Cargo.*" "(src)(/.*)?"];