rework module arguments

flake.nix

@@ -27,7 +27,7 @@
         }: {
           imports = [ ./module.nix ];
           config = lib.mkIf config.services.tasproxy.enable {
-            nixpkgs.overlays = [ outputs.overlays.default ];
+            nixpkgs.overlays = [ (import ./overlay.nix) ];
             services.tasproxy.package = lib.mkDefault pkgs.tasproxy;
           };
         };

module.nix

@@ -5,6 +5,24 @@
 }:
 with lib; let
   cfg = config.services.tasproxy;
+  format = pkgs.formats.toml { };
+  configFile = format.generate "tasproxy-config.toml" {
+    listen = {
+      inherit (cfg) socket;
+    };
+    mqtt = {
+      inherit (cfg.mqtt) hostname port;
+    } // (
+      optionalAttrs (cfg.mqtt.passwordFile != null) {
+        inherit (cfg.mqtt) username;
+        password_file = "$CREDENTIALS_DIRECTORY/mqtt_password";
+      }
+    );
+    tasmota = optionalAttrs (cfg.tasmota.username != null) {
+      inherit (cfg.tasmota) username;
+      password_file = "$CREDENTIALS_DIRECTORY/tasmota_password";
+    };
+  };
 in
 {
   options.services.tasproxy = {
@@ -13,12 +31,57 @@ in
     port = mkOption {
       type = types.int;
       default = 3000;
-      description = "port to listen on";
+      description = "port to listen on, if enableUnixSocket is not set";
     };
 
-    mqttCredentailsFile = mkOption {
+    socket = mkOption {
       type = types.str;
-      description = "file containg MQTT_HOSTNAME, MQTT_USERNAME and MQTT_PASSWORD variables";
+      default = "/run/tasproxy/tasproxy.socket";
+      description = "socket to listen on, if enableUnixSocket is set";
+    };
+
+    mqtt = mkOption {
+      type = types.submodule {
+        options = {
+          hostname = mkOption {
+            type = types.str;
+            description = "Hostname of the MQTT server";
+          };
+          port = mkOption {
+            type = types.port;
+            default = 1883;
+            description = "Port of the MQTT server";
+          };
+          username = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "Username for the MQTT server";
+          };
+          passwordFile = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "File containing the password for the MQTT server";
+          };
+        };
+      };
+    };
+
+    tasmota = mkOption {
+      type = types.submodule {
+        options = {
+          username = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "Username for the tasmota devices";
+          };
+          passwordFile = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "File containing the password for the tasmota devices";
+          };
+        };
+      };
+      default = { };
     };
 
     enableUnixSocket = mkOption {
@@ -37,18 +100,16 @@ in
   config = mkIf cfg.enable {
     systemd.services."tasproxy" = {
       wantedBy = [ "multi-user.target" ];
-      environment =
-        if cfg.enableUnixSocket
-        then {
-          SOCKET = "/run/tasproxy/tasproxy.sock";
-        }
-        else {
-          PORT = cfg.port;
-        };
 
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/tasproxy";
+        LoadCredential = (optional (cfg.mqtt.passwordFile != null) [
-        EnvironmentFile = cfg.mqttCredentailsFile;
+          "mqtt_password:${cfg.mqtt.passwordFile}"
+        ]) ++ (optional (cfg.tasmota.passwordFile != null) [
+          "tasmota_password:${cfg.tasmota.passwordFile}"
+        ]);
+
+        ExecStart = "${cfg.package}/bin/tasproxy ${configFile}";
+
         Restart = "on-failure";
         DynamicUser = true;
         PrivateTmp = true;
@@ -67,7 +128,7 @@ in
         ProtectHostname = true;
         LockPersonality = true;
         ProtectKernelTunables = true;
-        RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ] ++ optionals cfg.enableUnixSocket [ "AF_UNIX" ];
         RestrictRealtime = true;
         ProtectProc = "noaccess";
         SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];