flake

.dockerignore

@@ -1,2 +1,4 @@
 /target
 **/*.rs.bk
+result
+.direnv

.envrc

@@ -0,0 +1 @@
+use flake

.gitignore

@@ -1,2 +1,4 @@
 /target
 **/*.rs.bk
+result
+.direnv

flake.lock

@@ -0,0 +1,70 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "locked": {
+        "lastModified": 1656928814,
+        "narHash": "sha256-RIFfgBuKz6Hp89yRr7+NR5tzIAbn52h8vT6vXkYjZoM=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "7e2a3b3dfd9af950a856d66b0a7d01e3c18aa249",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "naersk": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1655042882,
+        "narHash": "sha256-9BX8Fuez5YJlN7cdPO63InoyBy7dm3VlJkkmTt6fS1A=",
+        "owner": "nix-community",
+        "repo": "naersk",
+        "rev": "cddffb5aa211f50c4b8750adbec0bbbdfb26bb9f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "naersk",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 0,
+        "narHash": "sha256-XZ1fKlEkAQvgocuBYq9lXEP3eNW6gF9JHsPVsvkWMhU=",
+        "path": "/nix/store/2xbq6yjs2lf2j0438h162mf66jvg0wyg-source",
+        "type": "path"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 0,
+        "narHash": "sha256-XZ1fKlEkAQvgocuBYq9lXEP3eNW6gF9JHsPVsvkWMhU=",
+        "path": "/nix/store/2xbq6yjs2lf2j0438h162mf66jvg0wyg-source",
+        "type": "path"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "naersk": "naersk",
+        "nixpkgs": "nixpkgs_2"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,93 @@
+{
+  inputs = {
+    flake-utils.url = "github:numtide/flake-utils";
+    naersk.url = "github:nix-community/naersk";
+  };
+
+  outputs = {
+    self,
+    nixpkgs,
+    flake-utils,
+    naersk,
+  }:
+    flake-utils.lib.eachDefaultSystem (
+      system: let
+        pkgs = nixpkgs.legacyPackages."${system}";
+        naersk-lib = naersk.lib."${system}";
+      in rec {
+        # `nix build`
+        packages.prometheus-mdns-sd = naersk-lib.buildPackage {
+          pname = "prometheus-mdns-sd";
+          root = ./.;
+        };
+        defaultPackage = packages.prometheus-mdns-sd;
+        defaultApp = packages.prometheus-mdns-sd;
+
+        # `nix develop`
+        devShell = pkgs.mkShell {
+          nativeBuildInputs = with pkgs; [rustc cargo bacon cargo-edit cargo-outdated];
+        };
+      }
+    )
+    // {
+      nixosModule = {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+        with lib; let
+          cfg = config.services.prometheus-mdns-sd;
+        in {
+          options.services.prometheus-mdns-sd = {
+            enable = mkEnableOption "WiFi prometheus exporter";
+
+            target = mkOption {
+              type = types.str;
+              default = "/run/prometheus-mdns-sd/services.json";
+              description = "json file to write the discovered services to";
+            };
+          };
+
+          config = mkIf cfg.enable {
+            systemd.services."prometheus-mdns-sd" = let
+              pkg = self.defaultPackage.${pkgs.system};
+            in {
+              wantedBy = ["multi-user.target"];
+              script = "${pkg}/bin/prometheus-mdns-sd-rs ${cfg.target}";
+
+              serviceConfig = {
+                Restart = "on-failure";
+                DynamicUser = true;
+                PrivateTmp = true;
+                ProtectSystem = "strict";
+                ProtectHome = true;
+                NoNewPrivileges = true;
+                PrivateDevices = true;
+                ProtectClock = true;
+                CapabilityBoundingSet = true;
+                ProtectKernelLogs = true;
+                ProtectControlGroups = true;
+                SystemCallArchitectures = "native";
+                ProtectKernelModules = true;
+                RestrictNamespaces = true;
+                MemoryDenyWriteExecute = true;
+                ProtectHostname = true;
+                LockPersonality = true;
+                ProtectKernelTunables = true;
+                RestrictAddressFamilies = "AF_INET";
+                RestrictRealtime = true;
+                ProtectProc = "noaccess";
+                SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];
+                IPAddressDeny = "any";
+                IPAddressAllow = ["multicast" "192.168.0.0/16"];
+                PrivateUsers = true;
+                ProcSubset = "pid";
+                RuntimeDirectory = "prometheus-mdns-sd";
+                RestrictSUIDSGID = true;
+              };
+            };
+          };
+        };
+    };
+}