helvetica/puter
1
0
Fork 0
Code Activity

update

Browse source
This commit is contained in:
Lukas Wurzinger 2025-06-03 17:34:01 +02:00
parent 36bfa7523c
commit 7554b37f68
No known key found for this signature in database
1 changed files with 0 additions and 143 deletions
Download patch file Download diff file Expand all files Collapse all files

143
modules/filebrowser.nix
View file

@ -1,143 +0,0 @@
{
config,
pkgs,
lib,
utils,
...
}:
let
cfg = config.services.filebrowser;
inherit (lib) types;
format = pkgs.formats.json { };
in
{
options = {
services.filebrowser = {
enable = lib.mkEnableOption "FileBrowser";
package = lib.mkPackageOption pkgs "filebrowser" { };
openFirewall = lib.mkOption {
default = false;
description = ''
Whether to automatically open the ports for FileBrowser in the firewall.
'';
type = types.bool;
};
settings = lib.mkOption {
default = { };
description = ''
Settings for FileBrowser.
Refer to <https://filebrowser.org/cli/filebrowser#options> for all supported values.
'';
type = types.submodule {
freeformType = format.type;
options = {
address = lib.mkOption {
default = "localhost";
description = ''
The address to listen on.
'';
type = types.str;
};
port = lib.mkOption {
default = 8080;
description = ''
The port to listen on.
'';
type = types.port;
};
root = lib.mkOption {
default = "/var/lib/filebrowser/data";
description = ''
The directory where FileBrowser stores files.
'';
type = types.path;
};
database = lib.mkOption {
default = "/var/lib/filebrowser/database.db";
description = ''
The path to FileBrowser's Bolt database.
'';
type = types.path;
};
cache-dir = lib.mkOption {
default = "/var/cache/filebrowser";
description = ''
The directory where FileBrowser stores its cache.
'';
type = types.path;
readOnly = true;
};
};
};
};
};
};
config = lib.mkIf cfg.enable {
systemd = {
services.filebrowser = {
after = [ "network.target" ];
description = "FileBrowser";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart =
let
args = [
(lib.getExe cfg.package)
"--config"
(format.generate "config.json" cfg.settings)
];
in
utils.escapeSystemdExecArgs args;
StateDirectory = "filebrowser";
CacheDirectory = "filebrowser";
WorkingDirectory = cfg.settings.root;
DynamicUser = true;
NoNewPrivileges = true;
PrivateDevices = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
MemoryDenyWriteExecute = true;
LockPersonality = true;
RestrictAddressFamilies = [
"AF_UNIX"
"AF_INET"
"AF_INET6"
];
DevicePolicy = "closed";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
};
tmpfiles.settings.filebrowser =
lib.genAttrs
[
cfg.settings.root
(builtins.dirOf cfg.settings.database)
]
(_: {
d.mode = "0700";
});
};
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.settings.port ];
};
meta.maintainers = [
lib.maintainers.lukaswrz
];
}