helvetica/puter
1
0
Fork 0
Code Activity

stuff

Browse source
This commit is contained in:
Lukas Wurzinger 2025-05-19 22:25:14 +02:00
parent 38ff240494
commit e7cb8ff3f2
No known key found for this signature in database
2 changed files with 31 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

1
hosts/abacus/filebrowser.nix
View file

@ -7,7 +7,6 @@ in{
settings = { settings = {
address = "localhost"; address = "localhost";
port = 8090; port = 8090;
database = "/var/lib/filebrowser/filebrowser.db";
}; };
}; };

94
modules/filebrowser.nix
View file

@ -2,15 +2,12 @@
config, config,
pkgs, pkgs,
lib, lib,
utils,
... ...
}: }:
let let
cfg = config.services.filebrowser; cfg = config.services.filebrowser;
inherit (lib) types; inherit (lib) types;
format = pkgs.formats.json { }; format = pkgs.formats.json { };
defaultUser = "filebrowser";
defaultGroup = "filebrowser";
in in
{ {
options = { options = {
@ -19,22 +16,6 @@ in
package = lib.mkPackageOption pkgs "filebrowser" { }; package = lib.mkPackageOption pkgs "filebrowser" { };
user = lib.mkOption {
type = types.str;
default = defaultUser;
description = ''
The name of the user account under which FileBrowser should run.
'';
};
group = lib.mkOption {
type = types.str;
default = defaultGroup;
description = ''
The name of the user group under which FileBrowser should run.
'';
};
openFirewall = lib.mkOption { openFirewall = lib.mkOption {
default = false; default = false;
description = '' description = ''
@ -44,11 +25,19 @@ in
}; };
stateDir = lib.mkOption { stateDir = lib.mkOption {
default = "/var/lib/filebrowser"; default = "filebrowser";
description = '' description = ''
The directory where FileBrowser stores its state. The directory below `/var/lib` where FileBrowser stores its state.
''; '';
type = types.path; type = types.str;
};
cacheDir = lib.mkOption {
default = "cache";
description = ''
The directory below `/var/cache` where FileBrowser stores its cache.
'';
type = types.nullOr types.str;
}; };
settings = lib.mkOption { settings = lib.mkOption {
@ -77,9 +66,9 @@ in
}; };
root = lib.mkOption { root = lib.mkOption {
default = "${cfg.stateDir}/data"; default = "/var/lib/${cfg.stateDir}/data";
defaultText = lib.literalExpression '' defaultText = lib.literalExpression ''
"''${config.services.filebrowser.stateDir}/data" "/var/lib/''${config.services.filebrowser.stateDir}/data"
''; '';
description = '' description = ''
The directory where FileBrowser stores files. The directory where FileBrowser stores files.
@ -88,9 +77,9 @@ in
}; };
database = lib.mkOption { database = lib.mkOption {
default = "/var/lib//database.db"; default = "/var/lib/${cfg.stateDir}/database.db";
defaultText = lib.literalExpression '' defaultText = lib.literalExpression ''
"''${config.services.filebrowser.stateDir}/database.db" "/var/lib/''${config.services.filebrowser.stateDir}/database.db"
''; '';
description = '' description = ''
The path to FileBrowser's Bolt database. The path to FileBrowser's Bolt database.
@ -99,14 +88,15 @@ in
}; };
cache-dir = lib.mkOption { cache-dir = lib.mkOption {
default = "${cfg.stateDir}/cache"; default = "/var/cache/${cfg.cacheDir}";
defaultText = lib.literalExpression '' defaultText = lib.literalExpression ''
"''${config.services.filebrowser.stateDir}/cache" "/var/cache/''${config.services.filebrowser.cacheDir}"
''; '';
description = '' description = ''
The directory where FileBrowser stores its cache. The directory where FileBrowser stores its cache.
''; '';
type = types.nullOr types.path; type = types.nullOr types.path;
readOnly = true;
}; };
}; };
}; };
@ -121,25 +111,13 @@ in
description = "FileBrowser"; description = "FileBrowser";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
serviceConfig = { serviceConfig = {
ExecStart =
let
args = [
(lib.getExe cfg.package)
"--config"
(format.generate "config.json" cfg.settings)
];
in
utils.escapeSystemdExecArgs args;
StateDirectory = cfg.stateDir; StateDirectory = cfg.stateDir;
WorkingDirectory = cfg.settings.root; CacheDirectory = lib.mkIf (cfg.cacheDir != null) cfg.cacheDir;
User = cfg.user; DynamicUser = true;
Group = cfg.group;
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateDevices = true; PrivateDevices = true;
ProtectSystem = "full";
ProtectKernelTunables = true; ProtectKernelTunables = true;
ProtectKernelModules = true; ProtectKernelModules = true;
ProtectControlGroups = true; ProtectControlGroups = true;
@ -150,42 +128,26 @@ in
"AF_INET" "AF_INET"
"AF_INET6" "AF_INET6"
]; ];
PrivateTmp = true;
DevicePolicy = "closed"; DevicePolicy = "closed";
RestrictNamespaces = true; RestrictNamespaces = true;
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
}; };
};
tmpfiles.settings.filebrowser = script = ''
lib.genAttrs mkdir --parents -- ${lib.escapeShellArgs [
(
[
cfg.stateDir
cfg.settings.root cfg.settings.root
(builtins.dirOf cfg.settings.database) (builtins.dirOf cfg.settings.database)
] ]}
++ (lib.optional (cfg.settings.cache-dir != null) cfg.settings.cache-dir)
) cd -- ${lib.escapeShellArg cfg.settings.root}
(_: {
d = { exec ${lib.getExe cfg.package} --config ${format.generate "config.json" cfg.settings}
inherit (cfg) user group; '';
mode = "0700";
}; };
});
}; };
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.settings.port ]; networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.settings.port ];
users = {
users.${cfg.user} = lib.mkIf (cfg.user == defaultUser) {
home = cfg.stateDir;
group = cfg.group;
isSystemUser = true;
};
groups.${cfg.group} = lib.mkIf (cfg.group == defaultGroup) { };
};
}; };
meta.maintainers = [ meta.maintainers = [