68 lines
1.8 KiB
Nix
68 lines
1.8 KiB
Nix
{ ... }: {
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}: let
|
|
cfg = config.hectic.services.attic;
|
|
environmentFile = "/var/lib/atticd/credentials.env";
|
|
in {
|
|
options.hectic.services.attic = {
|
|
enable = lib.mkEnableOption "Attic binary cache server";
|
|
|
|
hostName = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Public hostname used by clients to reach this Attic server.";
|
|
};
|
|
|
|
listenAddress = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "127.0.0.1";
|
|
description = "Local address atticd binds to behind the reverse proxy.";
|
|
};
|
|
|
|
port = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = 8080;
|
|
description = "Local port atticd binds to behind the reverse proxy.";
|
|
};
|
|
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
systemd.services.atticd-credentials = {
|
|
description = "Generate persistent atticd credentials";
|
|
before = [ "atticd.service" ];
|
|
wantedBy = [ "atticd.service" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
StateDirectory = "atticd";
|
|
UMask = "0077";
|
|
};
|
|
script = ''
|
|
if [ -s ${environmentFile} ]; then
|
|
exit 0
|
|
fi
|
|
|
|
install -m 0700 -d /var/lib/atticd
|
|
secret="$(${lib.getExe pkgs.openssl} genrsa -traditional 4096 | ${pkgs.coreutils}/bin/base64 -w0)"
|
|
cat > ${environmentFile} <<EOF
|
|
ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64="$secret"
|
|
EOF
|
|
chmod 0600 ${environmentFile}
|
|
'';
|
|
};
|
|
|
|
services.atticd = {
|
|
enable = true;
|
|
environmentFile = environmentFile;
|
|
settings = {
|
|
listen = "${cfg.listenAddress}:${toString cfg.port}";
|
|
allowed-hosts = [ cfg.hostName ];
|
|
api-endpoint = "https://${cfg.hostName}/";
|
|
compression.type = "zstd";
|
|
};
|
|
};
|
|
};
|
|
}
|