🏡 index : ~doyle/bin.git

793c2476af0f62885be7b0358b2913e87d346a03 [patch]

46c9f8c65773de74b02acbc45c5fdd3c02504976

4fe099fd3e644c956026fc8795d68c0aaa200dc0

793c2476af0f62885be7b0358b2913e87d346a03.tar.gz

Add flake.nix

Diff

 .gitignore |  1 +-
 flake.lock | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 flake.nix  | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 161 insertions(+)

diff --git a/.gitignore b/.gitignore
index b6b1ad5..07821c7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@

# These are backup files generated by rustfmt
**/*.rs.bk
result
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..d2134be
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,77 @@
{
  "nodes": {
    "naersk": {
      "inputs": {
        "nixpkgs": "nixpkgs"
      },
      "locked": {
        "lastModified": 1662220400,
        "narHash": "sha256-9o2OGQqu4xyLZP9K6kNe1pTHnyPz0Wr3raGYnr9AIgY=",
        "owner": "nix-community",
        "repo": "naersk",
        "rev": "6944160c19cb591eb85bbf9b2f2768a935623ed3",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "ref": "master",
        "repo": "naersk",
        "type": "github"
      }
    },
    "nixpkgs": {
      "locked": {
        "lastModified": 1670118144,
        "narHash": "sha256-tdh9H4oomljZaKpCkZox8jmwt8p78oGLpK9cjFBy3Qk=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "95f1ec721652d91a2993311d6cf537d3724690be",
        "type": "github"
      },
      "original": {
        "id": "nixpkgs",
        "type": "indirect"
      }
    },
    "nixpkgs_2": {
      "locked": {
        "lastModified": 1670118144,
        "narHash": "sha256-tdh9H4oomljZaKpCkZox8jmwt8p78oGLpK9cjFBy3Qk=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "95f1ec721652d91a2993311d6cf537d3724690be",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "ref": "nixpkgs-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
        "naersk": "naersk",
        "nixpkgs": "nixpkgs_2",
        "utils": "utils"
      }
    },
    "utils": {
      "locked": {
        "lastModified": 1667395993,
        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
        "owner": "numtide",
        "repo": "flake-utils",
        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "flake-utils",
        "type": "github"
      }
    }
  },
  "root": "root",
  "version": 7
}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..b742a61
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,83 @@
{
  inputs = {
    naersk.url = "github:nix-community/naersk/master";
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, utils, naersk }:
    utils.lib.eachDefaultSystem (system:
      let
        pkgs = import nixpkgs { inherit system; };
        naersk-lib = pkgs.callPackage naersk { };
      in
      {
        defaultPackage = naersk-lib.buildPackage ./.;
        devShell = with pkgs; mkShell {
          buildInputs = [ cargo rustc rustfmt pre-commit rustPackages.clippy ];
          RUST_SRC_PATH = rustPlatform.rustLibSrc;
        };

        nixosModules.default = { config, lib, pkgs, ... }:
          with lib;
          let
            cfg = config.services.paste-bin;
          in
          {
            options.services.paste-bin = {
              enable = mkEnableOption "paste-bin";
              bindAddress = mkOption {
                default = "[::]:8000";
                description = "Address and port to listen on";
                type = types.str;
              };
              maxPasteSize = mkOption {
                default = 32768;
                description = "Max allowed size of an individual paste";
                type = types.int;
              };
              bufferSize = mkOption {
                default = 1000;
                description = "Maximum amount of pastes to store at a time";
                type = types.int;
              };
            };

            config = mkIf cfg.enable {
              systemd.services.bin = {
                enable = true;
                wantedBy = [ "multi-user.target" ];
                after = [ "network-online.target" ];
                serviceConfig = {
                  Type = "exec";
                  ExecStart = "${self.defaultPackage."${system}"}/bin/bin --buffer-size ${toString cfg.bufferSize} --max-paste-size ${toString cfg.maxPasteSize} ${cfg.bindAddress}";
                  Restart = "on-failure";

                  CapabilityBoundingSet = "";
                  NoNewPrivileges = true;
                  PrivateDevices = true;
                  PrivateTmp = true;
                  PrivateUsers = true;
                  PrivateMounts = true;
                  ProtectHome = true;
                  ProtectClock = true;
                  ProtectProc = "noaccess";
                  ProcSubset = "pid";
                  ProtectKernelLogs = true;
                  ProtectKernelModules = true;
                  ProtectKernelTunables = true;
                  ProtectControlGroups = true;
                  ProtectHostname = true;
                  RestrictSUIDSGID = true;
                  RestrictRealtime = true;
                  RestrictNamespaces = true;
                  LockPersonality = true;
                  RemoveIPC = true;
                  RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
                  SystemCallFilter = [ "@system-service" "~@privileged" ];
                };
              };
            };
          };
      });
}