grace/dots

dotfiles/nix configs

git clone https://git.gae.moe/grace/dots

Grace Yoderbig changesc1be8e3

main
branchesidkmainvulcanwafrn-testingall refs →
1.8 KiB75 linesraw
1{ lib, pkgs, ... }:
2
3let
4  host = import ../hosts.nix;
5  tailnet = import ../tailnet.nix;
6  configuration = pkgs.writeText "copyparty.conf" ''
7    [global]
8      i: 0.0.0.0
9      p: 8080
10      rproxy: 1
11      xff-src: ${tailnet.knuth}
12      idp-h-usr: Remote-User
13      auth-ord: idp,pw
14      idp-login: https://auth.gae.moe
15      hist: /mnt/data/copyparty/history
16      e2dsa
17      no-reload
18      no-robots
19      chmod-f: 660
20      chmod-d: 2770
21
22    [/]
23      /mnt/data/share
24      accs:
25        rwmd: ${host.user}
26      flags:
27        scan: 300
28  '';
29in
30{
31  imports = [ ./share.nix ];
32
33  users.users.copyparty = {
34    isSystemUser = true;
35    group = "share";
36    home = "/mnt/data/copyparty";
37  };
38
39  systemd.tmpfiles.rules = [
40    "d /mnt/data/copyparty 0700 copyparty share -"
41  ];
42
43  networking.firewall.allowedTCPPorts = [ 8080 ];
44  environment.etc."copyparty/config.conf".source = configuration;
45  environment.systemPackages = [ pkgs.copyparty ];
46
47  systemd.services.copyparty = {
48    description = "Copyparty file server";
49    wantedBy = [ "multi-user.target" ];
50    after = [ "network.target" ];
51    unitConfig.RequiresMountsFor = [ "/mnt/data" ];
52    environment = {
53      PYTHONUNBUFFERED = "1";
54      XDG_CONFIG_HOME = "/mnt/data/copyparty";
55    };
56    serviceConfig = {
57      User = "copyparty";
58      Group = "share";
59      WorkingDirectory = "/mnt/data/copyparty";
60      ExecStart = "${lib.getExe pkgs.copyparty} -c ${configuration} -c %d/accounts.conf";
61      LoadCredential = [ "accounts.conf:/etc/secrets/copyparty.conf" ];
62      Restart = "on-failure";
63      RestartSec = 5;
64      UMask = "0007";
65      NoNewPrivileges = true;
66      PrivateTmp = true;
67      ProtectHome = true;
68      ProtectSystem = "strict";
69      ReadWritePaths = [
70        "/mnt/data/share"
71        "/mnt/data/copyparty"
72      ];
73    };
74  };
75}