blob: abf348ee6dbae7266819af0a5f9ce7bc1c9669a6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
self: {
config,
lib,
modulesPath,
pkgs,
...
}: let
cfg = config.services.guzzle-api;
inherit
(lib)
literalExpression
mkDefault
mdDoc
mkEnableOption
mkIf
mkMerge
mkOption
mkPackageOption
types
;
proto = "http${lib.optionalString cfg.nginx.addSSL "s"}";
hostPortSubmodule = {
options = {
host = mkOption {
description = mdDoc "the hostname";
type = types.str;
};
port = mkOption {
description = mdDoc "the port";
type = types.port;
};
};
};
in {
options.services.guzzle-api = {
enable = mkEnableOption "guzzle-api";
listen = mkOption {
description = mdDoc "address and port to listen to";
type = types.submodule hostPortSubmodule;
default = {
host = "localhost";
port = 7240;
};
defaultText = literalExpression ''
{
address = "localhost";
port = 7240;
}
'';
};
domain = mkOption {
description = mdDoc "FQDN for guzzle_api endpoint";
type = types.str;
};
nginx = mkOption {
description = mdDoc ''
With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr.
Set to {} if you do not need any customization to the virtual host.
If enabled, then by default, the {option}`serverName` is
`''${domain}`,
If this is set to null (the default), no nginx virtualHost will be configured.
'';
type = types.nullOr (types.submodule (
import (modulesPath + "/services/web-servers/nginx/vhost-options.nix") {inherit config lib;}
));
default = null;
example = literalExpression ''
{
enableACME = true;
forceSSL = true;
}
'';
};
package = mkPackageOption self.packages.${pkgs.stdenv.hostPlatform.system} "guzzle-api-server" {};
};
config = mkIf cfg.enable {
systemd.services.guzzle-api = {
enable = mkDefault true;
wantedBy = ["multi-user.target"];
after = ["network.target"];
script = ''
URL="${proto}://${cfg.domain}" ${cfg.package}/bin/guzzle-api-server --host ${cfg.listen.host} --port ${toString cfg.listen.port}
'';
serviceConfig = mkDefault {
Type = "simple";
Restart = "always";
# hardening
DynamicUser = true;
PrivateTmp = true;
NoNewPrivileges = true;
RestrictNamespaces = "uts ipc pid user cgroup";
ProtectSystem = "strict";
ProtectHome = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
PrivateDevices = true;
RestrictSUIDSGID = true;
};
};
services.nginx = mkIf (cfg.nginx != null) {
enable = true;
virtualHosts."${cfg.domain}" = mkMerge [
{
locations."/" = {
proxyPass = "http://${cfg.listen.host}:${toString cfg.listen.port}";
};
}
cfg.nginx
];
};
};
}
|
