From 9636d52a14f413906b0d9919de2e38a623a3b16c Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Mon, 19 Oct 2026 22:51:35 -0400
Subject: [PATCH] refactor(nixos): separate RomM service policy

---
 configs/nixos/guests/romm.nix           | 25 ++---------
 configs/nixos/modules/services/romm.nix | 56 +++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 22 deletions(-)
 create mode 100644 configs/nixos/modules/services/romm.nix

diff --git a/configs/nixos/guests/romm.nix b/configs/nixos/guests/romm.nix
index 4db8202..394a2a0 100644
--- a/configs/nixos/guests/romm.nix
+++ b/configs/nixos/guests/romm.nix
@@ -130,29 +130,10 @@ in
           }
         ];
 
-    registry."stable-uid".${config.networking.hostName} = {
-      romm = 20005;
-      "redis-romm" = 20006;
-    };
-
     guests.romm = {
-      interior = {
-        networking.firewall.allowedTCPPorts = [ 80 ];
-
-        services.romm = {
-          enable = true;
-          group = "storage";
-          database.createLocally = true;
-          redis.createLocally = true;
-          watcher.enable = true;
-          nginx.virtualHost = cfg.reverseProxy.route.domain;
-          inherit environmentFile;
-        };
-
-        users.users = {
-          romm.uid = rommUid;
-          redis-romm.uid = redisUid;
-        };
+      interior.modules.services.romm = {
+        enable = true;
+        virtualHost = cfg.reverseProxy.route.domain;
       };
 
       mounts = {
diff --git a/configs/nixos/modules/services/romm.nix b/configs/nixos/modules/services/romm.nix
new file mode 100644
index 0000000..94d3226
--- /dev/null
+++ b/configs/nixos/modules/services/romm.nix
@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.modules.services.romm;
+  rommUid = config.registry."stable-uid".${config.networking.hostName}.romm;
+  redisUid = config.registry."stable-uid".${config.networking.hostName}."redis-romm";
+in
+{
+  options.modules.services.romm = {
+    enable = lib.mkEnableOption "RomM";
+
+    environmentFile = lib.mkOption {
+      type = lib.types.path;
+      default = "/run/secrets/romm.env";
+      readOnly = true;
+      description = "Path to RomM's environment file.";
+    };
+
+    virtualHost = lib.mkOption {
+      type = lib.types.str;
+      example = "romm.example.org";
+      description = "Public host name configured in RomM's nginx.";
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      registry."stable-uid".${config.networking.hostName} = {
+        romm = 20005;
+        "redis-romm" = 20006;
+      };
+    }
+
+    (lib.mkIf cfg.enable {
+      networking.firewall.allowedTCPPorts = [ 80 ];
+
+      services.romm = {
+        enable = true;
+        group = "storage";
+        database.createLocally = true;
+        redis.createLocally = true;
+        watcher.enable = true;
+        nginx.virtualHost = cfg.virtualHost;
+        inherit (cfg) environmentFile;
+      };
+
+      users.users = {
+        romm.uid = rommUid;
+        redis-romm.uid = redisUid;
+      };
+    })
+  ];
+}