felixalb/pvv-nixos-config
1
0
Fork 0
mirror of https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git synced 2025-04-03 04:31:22 +02:00
Code Issues Projects Releases Wiki Activity

WIP: gickup module

Browse Source
This commit is contained in:
h7x4 2025-03-30 17:18:28 +02:00
parent d59a3f6ec0
commit cf7f4c996f
No known key found for this signature in database
GPG Key ID: 9F2F7D8250F35146
2 changed files with 90 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
flake.nix
View File

@ -91,6 +91,7 @@
modules = [
inputs.matrix-next.nixosModules.default
inputs.pvv-calendar-bot.nixosModules.default
self.nixosModules.gickup
];
overlays = [
inputs.pvv-calendar-bot.overlays.x86_64-linux.default
@ -164,6 +165,7 @@
snakeoil-certs = ./modules/snakeoil-certs.nix;
snappymail = ./modules/snappymail.nix;
robots-txt = ./modules/robots-txt.nix;
gickup = ./modules/gickup.nix;
};
devShells = forAllSystems (system: {

88
modules/gickup.nix Normal file
View File

@ -0,0 +1,88 @@
{ config, pkgs, lib, ... }:
let
cfg = config.services.gickup;
format = pkgs.formats.yaml { };
in
{
options.services.gickup = {
enable = lib.mkEnableOption "gickup, a git repository mirroring service";
package = lib.mkPackageOption pkgs "gickup" { };
gitPackage = lib.mkPackageOption pkgs "git" { };
gitLfsPackage = lib.mkPackageOption pkgs "git-lfs" { };
settings = lib.mkOption {
type = lib.types.submodule {
freeformType = format.type;
};
};
};
config = lib.mkIf cfg.enable {
users.users.gickup = {
isSystemUser = true;
group = "gickup";
home = "/var/lib/gickup";
};
users.groups.gickup = { };
systemd.services.gickup = {
description = "Gickup git repository mirroring service";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
path = [
cfg.gitPackage
cfg.gitLfsPackage
];
serviceConfig = {
ExecStart = utils.escapeSystemdExecArgs [
(lib.getExe cfg.package)
(format.generate "gickup-settings.conf" cfg.settings)
];
StateDirectory = "gickup";
WorkingDirectory = "gickup";
RuntimeDirectory = "gickup";
RuntimeDirectoryMode = "0700";
# Hardening options
AmbientCapabilities = [];
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@resources"
"~@privileged"
];
UMask = "0002";
CapabilityBoundingSet = [];
};
};
};
}