Commit 50d1876c authored by bas's avatar bas
Browse files

nixos/autobrr: use AUTOBRR__SESSION_SECRET_FILE

parent 56244089

nixos/modules/services/misc/autobrr.nix

+29 −18
Original line number Diff line number Diff line
@@ -8,8 +8,7 @@ 
let

  cfg = config.services.autobrr;

  configFormat = pkgs.formats.toml { };

  configTemplate = configFormat.generate "autobrr.toml" cfg.settings;

  templaterCmd = ''${lib.getExe pkgs.dasel} put -f '${configTemplate}' -v "$(${config.systemd.package}/bin/systemd-creds cat sessionSecret)" -o %S/autobrr/config.toml "sessionSecret"'';

  configFile = configFormat.generate "autobrr.toml" cfg.settings;

in

{

  options = {
@@ -79,7 +78,17 @@ in 
      }

    ];



    systemd.services.autobrr = {

    systemd = {

      tmpfiles.settings = {

        "10-autobrr" = {

          # DynamicUser uses /var/lib/private/

          "/var/lib/private/autobrr/config.toml"."L+" = {

            argument = "${configFile}";

          };

        };

      };



      services.autobrr = {

        description = "Autobrr";

        after = [

          "syslog.target"
@@ -87,17 +96,19 @@ in 
        ];

        wants = [ "network-online.target" ];

        wantedBy = [ "multi-user.target" ];

        restartTriggers = [ configFile ];



        serviceConfig = {

          Type = "simple";

          DynamicUser = true;

          LoadCredential = "sessionSecret:${cfg.secretFile}";

          Environment = [ "AUTOBRR__SESSION_SECRET_FILE=%d/sessionSecret" ];

          StateDirectory = "autobrr";

        ExecStartPre = "${lib.getExe pkgs.bash} -c '${templaterCmd}'";

          ExecStart = "${lib.getExe cfg.package} --config %S/autobrr";

          Restart = "on-failure";

        };

      };

    };



    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.settings.port ]; };

  };