robin/tasproxy
1
0
Fork 0
mirror of https://codeberg.org/icewind/tasproxy.git synced 2026-06-03 18:24:08 +02:00
Code Issues Projects Releases Wiki Activity

rework module arguments

Browse source
This commit is contained in:
Robin Appelman 2024-10-28 14:27:56 +01:00
commit 030a2d1ba3
2 changed files with 76 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

89
module.nix
View file

@ -5,6 +5,24 @@
}:
with lib; let
cfg = config.services.tasproxy;
format = pkgs.formats.toml { };
configFile = format.generate "tasproxy-config.toml" {
listen = {
inherit (cfg) socket;
};
mqtt = {
inherit (cfg.mqtt) hostname port;
} // (
optionalAttrs (cfg.mqtt.passwordFile != null) {
inherit (cfg.mqtt) username;
password_file = "$CREDENTIALS_DIRECTORY/mqtt_password";
}
);
tasmota = optionalAttrs (cfg.tasmota.username != null) {
inherit (cfg.tasmota) username;
password_file = "$CREDENTIALS_DIRECTORY/tasmota_password";
};
};
in
{
options.services.tasproxy = {
@ -13,12 +31,57 @@ in
port = mkOption {
type = types.int;
default = 3000;
description = "port to listen on";
description = "port to listen on, if enableUnixSocket is not set";
};
mqttCredentailsFile = mkOption {
socket = mkOption {
type = types.str;
description = "file containg MQTT_HOSTNAME, MQTT_USERNAME and MQTT_PASSWORD variables";
default = "/run/tasproxy/tasproxy.socket";
description = "socket to listen on, if enableUnixSocket is set";
};
mqtt = mkOption {
type = types.submodule {
options = {
hostname = mkOption {
type = types.str;
description = "Hostname of the MQTT server";
};
port = mkOption {
type = types.port;
default = 1883;
description = "Port of the MQTT server";
};
username = mkOption {
type = types.nullOr types.str;
default = null;
description = "Username for the MQTT server";
};
passwordFile = mkOption {
type = types.nullOr types.str;
default = null;
description = "File containing the password for the MQTT server";
};
};
};
};
tasmota = mkOption {
type = types.submodule {
options = {
username = mkOption {
type = types.nullOr types.str;
default = null;
description = "Username for the tasmota devices";
};
passwordFile = mkOption {
type = types.nullOr types.str;
default = null;
description = "File containing the password for the tasmota devices";
};
};
};
default = { };
};
enableUnixSocket = mkOption {
@ -37,18 +100,16 @@ in
config = mkIf cfg.enable {
systemd.services."tasproxy" = {
wantedBy = [ "multi-user.target" ];
environment =
if cfg.enableUnixSocket
then {
SOCKET = "/run/tasproxy/tasproxy.sock";
}
else {
PORT = cfg.port;
};
serviceConfig = {
ExecStart = "${cfg.package}/bin/tasproxy";
EnvironmentFile = cfg.mqttCredentailsFile;
LoadCredential = (optional (cfg.mqtt.passwordFile != null) [
"mqtt_password:${cfg.mqtt.passwordFile}"
]) ++ (optional (cfg.tasmota.passwordFile != null) [
"tasmota_password:${cfg.tasmota.passwordFile}"
]);
ExecStart = "${cfg.package}/bin/tasproxy ${configFile}";
Restart = "on-failure";
DynamicUser = true;
PrivateTmp = true;
@ -67,7 +128,7 @@ in
ProtectHostname = true;
LockPersonality = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ] ++ optionals cfg.enableUnixSocket [ "AF_UNIX" ];
RestrictRealtime = true;
ProtectProc = "noaccess";
SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];