YouTubeTLDR/flake.nix at master · Milkshiift/YouTubeTLDR · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
{
  description = "YouTubeTLDR server";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
    crane.url = "github:ipetkov/crane";
    crane.inputs.nixpkgs.follows = "nixpkgs";
    fenix = {
        url = "github:nix-community/fenix";
        inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, flake-utils, fenix, crane, ... }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = import nixpkgs {
          inherit system;
        };

        rust-toolchain = fenix.packages.${system}.default.toolchain;
        craneLib = (crane.mkLib pkgs).overrideToolchain rust-toolchain;

        project = pkgs.lib.importTOML ./Cargo.toml;

        youtubetldr = craneLib.buildPackage {
          pname = project.package.name;
          version = project.package.version;
          src = ./.;
          nativeBuildInputs = with pkgs; [
            mold
          ];
          cargoExtraArgs = "--no-default-features --features rustls-tls";
        };
      in
      {
        packages.default = youtubetldr;

        devShells = {
          default = pkgs.mkShell {
            buildInputs = with pkgs; [
              openssl
              pkg-config
            ];
          };
        };
      }) // {
        nixosModules.default = { config, pkgs, ... }:
          let
            cfg = config.services.youtubetldr;
          in
          {
            options.services.youtubetldr = {
              enable = pkgs.lib.mkEnableOption "Enable the YouTubeTLDR server";

              ip = pkgs.lib.mkOption {
                type = pkgs.lib.types.str;
                default = "0.0.0.0";
                description = "IP address to bind to";
              };

              port = pkgs.lib.mkOption {
                type = pkgs.lib.types.port;
                default = 8000;
                description = "Port to listen on";
              };

              workers = pkgs.lib.mkOption {
                type = pkgs.lib.types.int;
                default = 4;
                description = "Number of worker threads";
              };
            };

            config = pkgs.lib.mkIf cfg.enable {
              systemd.services.youtubetldr = {
                description = "YouTubeTLDR server";
                after = [ "network.target" ];
                wantedBy = [ "multi-user.target" ];

                serviceConfig = {
                  ExecStart = "${self.packages.${pkgs.system}.default}/bin/YouTubeTLDR";
                  Restart = "on-failure";
                  User = "youtubetldr";
                  Group = "youtubetldr";
                  CapabilityBoundingSet = ""; # No capabilities
                  PrivateTmp = true; # Private /tmp and /var/tmp
                  NoNewPrivileges = true; # Prevent privilege escalation
                  ProtectSystem = "strict"; # Protect the /boot, /etc, /usr, and /opt hierarchies
                  ProtectHome = true; # Protect /home, /root, /run/user
                  RestrictSUIDSGID = true; # Prevent SUID/SGID bits from being set
                  RestrictRealtime = true; # Prevent realtime scheduling
                  RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; # Only allow IPv4 and IPv6 sockets
                  SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @module @obsolete @raw-io @reboot @swap" ]; # Restrict syscalls
                  Environment = [
                    "TLDR_IP=${cfg.ip}"
                    "TLDR_PORT=${toString cfg.port}"
                    "TLDR_WORKERS=${toString cfg.workers}"
                  ];
                };
              };

              users.users.youtubetldr = {
                isSystemUser = true;
                group = "youtubetldr";
              };

              users.groups.youtubetldr = {};
            };
          };
      };
}