Unverified Commit 24a1589e authored by Thiago Kenji Okada's avatar Thiago Kenji Okada Committed by GitHub
Browse files

Merge pull request #251996 from surfaceflinger/microbin 

microbin: add service
parents 383389d0 78039bcb

nixos/doc/manual/release-notes/rl-2311.section.md

+2 −0
Original line number Diff line number Diff line
@@ -97,6 +97,8 @@ 


- [ferretdb](https://www.ferretdb.io/), an open-source proxy, converting the MongoDB 6.0+ wire protocol queries to PostgreSQL or SQLite. Available as [services.ferretdb](options.html#opt-services.ferretdb.enable).



- [MicroBin](https://microbin.eu/), a feature rich, performant and secure text and file sharing web application, a "paste bin". Available as [services.microbin](#opt-services.microbin.enable).



- [NNCP](http://www.nncpgo.org/). Added nncp-daemon and nncp-caller services. Configuration is set with [programs.nncp.settings](#opt-programs.nncp.settings) and the daemons are enabled at [services.nncp](#opt-services.nncp.caller.enable).



- [tuxedo-rs](https://github.com/AaronErhardt/tuxedo-rs), Rust utilities for interacting with hardware from TUXEDO Computers.

nixos/modules/module-list.nix

+1 −0
Original line number Diff line number Diff line
@@ -1267,6 +1267,7 @@ 
  ./services/web-apps/mattermost.nix

  ./services/web-apps/mediawiki.nix

  ./services/web-apps/meme-bingo-web.nix

  ./services/web-apps/microbin.nix

  ./services/web-apps/miniflux.nix

  ./services/web-apps/monica.nix

  ./services/web-apps/moodle.nix

nixos/modules/services/web-apps/microbin.nix

0 → 100644
+93 −0
Original line number Diff line number Diff line 
{ config, lib, pkgs, ... }:



let

  cfg = config.services.microbin;

in

{

  options.services.microbin = {

    enable = lib.mkEnableOption (lib.mdDoc "MicroBin is a super tiny, feature rich, configurable paste bin web application");



    package = lib.mkPackageOption pkgs "microbin" { };



    settings = lib.mkOption {

      type = lib.types.submodule { freeformType = with lib.types; attrsOf (oneOf [ bool int str ]); };

      default = { };

      example = {

        MICROBIN_PORT = 8080;

        MICROBIN_HIDE_LOGO = false;

      };

      description = lib.mdDoc ''

        Additional configuration for MicroBin, see

        <https://microbin.eu/docs/installation-and-configuration/configuration/>

        for supported values.



        For secrets use passwordFile option instead.

      '';

    };



    dataDir = lib.mkOption {

      type = lib.types.str;

      default = "/var/lib/microbin";

      description = lib.mdDoc "Default data folder for MicroBin.";

    };



    passwordFile = lib.mkOption {

      type = lib.types.nullOr lib.types.path;

      default = null;

      example = "/run/secrets/microbin.env";

      description = lib.mdDoc ''

        Path to file containing environment variables.

        Useful for passing down secrets.

        Variables that can be considered secrets are:

         - MICROBIN_BASIC_AUTH_USERNAME

         - MICROBIN_BASIC_AUTH_PASSWORD

         - MICROBIN_ADMIN_USERNAME

         - MICROBIN_ADMIN_PASSWORD

         - MICROBIN_UPLOADER_PASSWORD

      '';

    };

  };



  config = lib.mkIf cfg.enable {

    services.microbin.settings = with lib; {

      MICROBIN_BIND = mkDefault "0.0.0.0";

      MICROBIN_DISABLE_TELEMETRY = mkDefault true;

      MICROBIN_LIST_SERVER = mkDefault false;

      MICROBIN_PORT = mkDefault "8080";

    };



    systemd.services.microbin = {

      after = [ "network.target" ];

      wantedBy = [ "multi-user.target" ];

      environment = lib.mapAttrs (_: v: if lib.isBool v then lib.boolToString v else toString v) cfg.settings;

      serviceConfig = {

        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];

        DevicePolicy = "closed";

        DynamicUser = true;

        EnvironmentFile = lib.optional (cfg.passwordFile != null) cfg.passwordFile;

        ExecStart = "${cfg.package}/bin/microbin";

        LockPersonality = true;

        MemoryDenyWriteExecute = true;

        PrivateDevices = true;

        PrivateUsers = true;

        ProtectClock = true;

        ProtectControlGroups = true;

        ProtectHostname = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "invisible";

        ReadWritePaths = cfg.dataDir;

        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];

        RestrictNamespaces = true;

        RestrictRealtime = true;

        StateDirectory = "microbin";

        SystemCallArchitectures = [ "native" ];

        SystemCallFilter = [ "@system-service" ];

        WorkingDirectory = cfg.dataDir;

      };

    };

  };



  meta.maintainers = with lib.maintainers; [ surfaceflinger ];

}