refactor(copyparty): simplify module helpers

configs/nixos/modules/services/copyparty.nix

@@ -7,95 +7,67 @@
 let
   cfg = config.modules.services.copyparty; # NOLINT(let_order)
 
-  volumeType = lib.types.submodule {
+  configScript =
-    options = {
+    let
-      path = lib.mkOption {
+      renderedReverseProxy = lib.optionalString cfg.reverseProxy.enable ''
-        type = lib.types.str;
+          rproxy: 1
-        description = "Filesystem path served by this volume.";
+          xff-hdr: x-forwarded-for
-      };
+        ${lib.concatStringsSep "\n" (map renderTrustedSource cfg.reverseProxy.trustedSources)}
+      '';
 
-      access = lib.mkOption {
+      renderTrustedSource = source: "  xff-src: ${source}";
-        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
-        default = { };
-        example = {
-          A = [ "alexion" ];
-        };
-        description = "Copyparty access map from permission string to account names.";
-      };
 
-      readOnly = lib.mkOption {
+      renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);
-        type = lib.types.bool;
-        default = false;
-        description = "Serve this volume read-only.";
-      };
 
-      flags = lib.mkOption {
+      renderVolume = urlPath: volume: ''
-        type = lib.types.listOf lib.types.str;
+        [${urlPath}]
-        default = [ ];
+          ${volume.path}
-        example = [ "dthumb" ];
+          accs:
-        description = "Copyparty volume flags.";
+        ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderAccess volume.access)}
-      };
+        ${lib.optionalString (volume.flags != [ ]) ''
-    };
+            flags:
-  };
+          ${renderFlags volume.flags}
+        ''}
+      '';
 
-  configScript = pkgs.writeShellScript "copyparty-config" ''
+      renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
-    set -eu
 
-    umask 077
+      renderFlags =
-    password="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
+        flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
 
-    cat > /run/copyparty/copyparty.conf <<EOF
+      defaultPermissionFlags =
-    [global]
-      p: ${toString cfg.port}
-      usernames
-      http-only
-      no-crt
-      no-thumb
-      no-snap
-      no-rescan
-      ses-db: ${cfg.stateDir}/sessions.db
-      chpw-db: ${cfg.stateDir}/chpw.json
-      shr-db: ${cfg.stateDir}/shares.db
-    ${renderedReverseProxy}
-    [accounts]
-      ${cfg.accountName}: $password
-
-    ${renderedVolumes}
-    EOF
-  '';
-  renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
-
-  hasFlag =
-    name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
-
-  defaultPermissionFlags =
-    flags:
-    lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
-    ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
-
-  renderFlags =
-    flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
-
-  renderVolume = urlPath: volume: ''
-    [${urlPath}]
-      ${volume.path}
-      accs:
-    ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderAccess volume.access)}
-    ${lib.optionalString (volume.flags != [ ]) ''
         flags:
-      ${renderFlags volume.flags}
+        lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
-    ''}
+        ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
-  '';
 
-  renderTrustedSource = source: "  xff-src: ${source}";
+      hasFlag =
+        name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
+    in
+    pkgs.writeShellScript "copyparty-config" ''
+      set -eu
 
-  renderedReverseProxy = lib.optionalString cfg.reverseProxy.enable ''
+      umask 077
-      rproxy: 1
+      password="$(${lib.getExe' pkgs.coreutils "tr"} -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
-      xff-hdr: x-forwarded-for
-    ${lib.concatStringsSep "\n" (map renderTrustedSource cfg.reverseProxy.trustedSources)}
-  '';
 
-  renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);
+      cat > /run/copyparty/copyparty.conf <<EOF
+      [global]
+        p: ${toString cfg.port}
+        usernames
+        http-only
+        no-crt
+        no-thumb
+        no-snap
+        no-rescan
+        ses-db: ${cfg.stateDir}/sessions.db
+        chpw-db: ${cfg.stateDir}/chpw.json
+        shr-db: ${cfg.stateDir}/shares.db
+      ${renderedReverseProxy}
+      [accounts]
+        ${cfg.accountName}: $password
+
+      ${renderedVolumes}
+      EOF
+    '';
 
 in
 {
@@ -140,7 +112,38 @@ in
     };
 
     volumes = lib.mkOption {
-      type = lib.types.attrsOf volumeType;
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            path = lib.mkOption {
+              type = lib.types.externalPath;
+              description = "Filesystem path served by this volume.";
+            };
+
+            access = lib.mkOption {
+              type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+              default = { };
+              example = {
+                A = [ "alexion" ];
+              };
+              description = "Copyparty access map from permission string to account names.";
+            };
+
+            readOnly = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Serve this volume read-only.";
+            };
+
+            flags = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              example = [ "dthumb" ];
+              description = "Copyparty volume flags.";
+            };
+          };
+        }
+      );
       default = { };
       description = "Copyparty volumes keyed by their URL path.";
     };