feat(nixos): deploy RomM guest

configs/nixos/guests/reverse-proxy.nix

@@ -13,11 +13,6 @@ in
         modules.services.reverse-proxy.enable = true;
 
         services.nginx.virtualHosts = {
-          "games.alexion.dev" = {
-            forceSSL = true;
-            enableACME = true;
-            locations."/".proxyPass = "http://10.23.20.32";
-          };
           "git.alexion.dev" = {
             forceSSL = true;
             enableACME = true;

configs/nixos/guests/romm.nix

@@ -0,0 +1,181 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.guests.romm;
+  rommUid = config.registry."stable-uid".${config.networking.hostName}.romm;
+  redisUid = config.registry."stable-uid".${config.networking.hostName}."redis-romm";
+in
+{
+  options.guests.romm = {
+    dataPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/romm";
+      description = "Host path mounted as RomM application data.";
+    };
+
+    postgresqlPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/romm/postgresql";
+      description = "Host path mounted as RomM's PostgreSQL data.";
+    };
+
+    redisPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/romm/redis";
+      description = "Host path mounted as RomM's Redis data.";
+    };
+
+    romsPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/roms";
+      description = "Host path mounted as RomM's ROM library.";
+    };
+
+    biosPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/bios";
+      description = "Host path mounted as RomM's BIOS library.";
+    };
+
+    usersPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/romm/users";
+      description = "Host path mounted as RomM's user assets.";
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions =
+      map
+        (path: {
+          assertion = path.value != null;
+          message = "guests.romm.${path.name} must point at the host directory that stores ${path.description}.";
+        })
+        [
+          {
+            name = "dataPath";
+            value = cfg.dataPath;
+            description = "RomM application data";
+          }
+          {
+            name = "postgresqlPath";
+            value = cfg.postgresqlPath;
+            description = "RomM PostgreSQL data";
+          }
+          {
+            name = "redisPath";
+            value = cfg.redisPath;
+            description = "RomM Redis data";
+          }
+          {
+            name = "romsPath";
+            value = cfg.romsPath;
+            description = "RomM's ROM library";
+          }
+          {
+            name = "biosPath";
+            value = cfg.biosPath;
+            description = "RomM's BIOS library";
+          }
+          {
+            name = "usersPath";
+            value = cfg.usersPath;
+            description = "RomM's user assets";
+          }
+        ];
+
+    guests.romm = {
+      interior = {
+        modules.services.romm.enable = true;
+        services.romm.nginx.virtualHost = cfg.reverseProxy.route.domain;
+      };
+
+      mounts = {
+        "/var/lib/romm" = {
+          directory = cfg.dataPath;
+          owner = rommUid;
+          group = "storage";
+          mode = "2770";
+        };
+        "/var/lib/postgresql" = {
+          directory = cfg.postgresqlPath;
+          owner = config.ids.uids.postgres;
+          group = "storage";
+          mode = "0700";
+        };
+        "/var/lib/redis-romm" = {
+          directory = cfg.redisPath;
+          owner = redisUid;
+          group = "storage";
+          mode = "0700";
+        };
+        "/var/lib/romm/library/roms" = {
+          directory = cfg.romsPath;
+          owner = rommUid;
+          group = "storage";
+          mode = "2770";
+        };
+        "/var/lib/romm/library/bios" = {
+          directory = cfg.biosPath;
+          owner = rommUid;
+          group = "storage";
+          mode = "2770";
+        };
+        "/var/lib/romm/assets/users" = {
+          directory = cfg.usersPath;
+          owner = rommUid;
+          group = "storage";
+          mode = "2770";
+        };
+        "/run/secrets/romm.env" = {
+          file = config.sops.templates."romm.env".path;
+          readOnly = true;
+        };
+      };
+
+      limits = {
+        memory = lib.mkDefault "4G";
+        cpu = lib.mkDefault "200%";
+        tasksMax = lib.mkDefault 512;
+      };
+    };
+
+    sops.secrets =
+      lib.genAttrs
+        [
+          "services/romm/igdb/client-id"
+          "services/romm/igdb/client-secret"
+          "services/romm/retroachievements/api-key"
+          "services/romm/screenscraper/user"
+          "services/romm/screenscraper/password"
+          "services/romm/steamgriddb/api-key"
+        ]
+        (_: {
+          sopsFile = ../secrets + "/${config.networking.hostName}.yaml";
+        });
+
+    sops.templates."romm.env" = {
+      owner = "root";
+      group = "storage";
+      mode = "0440";
+      content = ''
+        IGDB_CLIENT_ID=${config.sops.placeholder."services/romm/igdb/client-id"}
+        IGDB_CLIENT_SECRET=${config.sops.placeholder."services/romm/igdb/client-secret"}
+        SCREENSCRAPER_USER=${config.sops.placeholder."services/romm/screenscraper/user"}
+        SCREENSCRAPER_PASSWORD=${config.sops.placeholder."services/romm/screenscraper/password"}
+        RETROACHIEVEMENTS_API_KEY=${config.sops.placeholder."services/romm/retroachievements/api-key"}
+        STEAMGRIDDB_API_KEY=${config.sops.placeholder."services/romm/steamgriddb/api-key"}
+      '';
+    };
+  };
+}