146 lines
4.1 KiB
Nix
146 lines
4.1 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.guests.copyparty;
|
|
in
|
|
{
|
|
options.guests.copyparty = {
|
|
passwordSecret = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "services/copyparty/users/${config.user.name}/password";
|
|
description = "SOPS secret name that contains the Copyparty account password.";
|
|
};
|
|
|
|
statePath = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
default = null;
|
|
example = "/srv/copyparty";
|
|
description = "Host path bind-mounted as Copyparty's state directory.";
|
|
};
|
|
|
|
reverseProxy.trustedSources = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ ];
|
|
description = "IP ranges that may supply Copyparty's forwarded client IP header.";
|
|
};
|
|
|
|
volumes = lib.mkOption {
|
|
type = lib.types.attrsOf (
|
|
lib.types.submodule {
|
|
options = {
|
|
hostPath = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Host path bind-mounted into the Copyparty guest for this volume.";
|
|
};
|
|
|
|
path = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Guest path served by this Copyparty volume.";
|
|
};
|
|
|
|
access = lib.mkOption {
|
|
type = lib.types.attrsOf (lib.types.listOf lib.types.str);
|
|
default = { };
|
|
description = "Copyparty access map from permission string to account names.";
|
|
};
|
|
|
|
readOnly = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = "Serve this Copyparty volume read-only.";
|
|
};
|
|
|
|
flags = lib.mkOption {
|
|
type = lib.types.attrs;
|
|
default = { };
|
|
description = "Copyparty volume flags.";
|
|
};
|
|
};
|
|
}
|
|
);
|
|
default = { };
|
|
description = "Copyparty volumes keyed by their URL path.";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
assertions = [
|
|
{
|
|
assertion = cfg.statePath != null;
|
|
message = "guests.copyparty.statePath must point at the host directory that stores Copyparty state.";
|
|
}
|
|
{
|
|
assertion = cfg.volumes != { };
|
|
message = "guests.copyparty.volumes must declare the host's served Copyparty volumes.";
|
|
}
|
|
];
|
|
|
|
registry.homepage.${config.networking.hostName}.copyparty = {
|
|
tab = "Apps";
|
|
section = "Files";
|
|
name = "Copyparty";
|
|
description = "Files on ${config.networking.hostName}";
|
|
icon = "copyparty.svg";
|
|
href = lib.mkIf cfg.reverseProxy.enable "https://${cfg.reverseProxy.route.domain}/?h";
|
|
};
|
|
|
|
guests.copyparty = {
|
|
interior.modules.services.copyparty = {
|
|
enable = true;
|
|
passwordFile = "/run/secrets/${cfg.passwordSecret}";
|
|
reverseProxy = {
|
|
enable = cfg.reverseProxy.enable;
|
|
inherit (cfg.reverseProxy) trustedSources;
|
|
};
|
|
volumes = lib.mapAttrs (
|
|
_urlPath: volume:
|
|
{
|
|
inherit (volume)
|
|
path
|
|
readOnly
|
|
;
|
|
}
|
|
// lib.optionalAttrs (volume.access != { }) { inherit (volume) access; }
|
|
// lib.optionalAttrs (volume.flags != { }) { inherit (volume) flags; }
|
|
) cfg.volumes;
|
|
};
|
|
|
|
mounts = {
|
|
"/var/lib/copyparty" = {
|
|
directory = cfg.statePath;
|
|
owner = config.registry."stable-uid".${config.networking.hostName}.copyparty;
|
|
group = "storage";
|
|
mode = "0770";
|
|
};
|
|
${"/run/secrets/${cfg.passwordSecret}"} = {
|
|
file = config.sops.secrets.${cfg.passwordSecret}.path;
|
|
readOnly = true;
|
|
};
|
|
}
|
|
// lib.mapAttrs' (
|
|
_urlPath: volume:
|
|
lib.nameValuePair volume.path {
|
|
directory = volume.hostPath;
|
|
owner = "root";
|
|
group = "storage";
|
|
mode = "2770";
|
|
}
|
|
) cfg.volumes;
|
|
limits = {
|
|
memory = lib.mkDefault "2G";
|
|
cpu = lib.mkDefault "200%";
|
|
tasksMax = lib.mkDefault 512;
|
|
};
|
|
};
|
|
|
|
sops.secrets.${cfg.passwordSecret} = {
|
|
owner = "root";
|
|
group = "storage";
|
|
mode = "0440";
|
|
};
|
|
};
|
|
}
|