diff options
author | sefidel <contact@sefidel.net> | 2024-01-24 13:29:27 +0900 |
---|---|---|
committer | sefidel <contact@sefidel.net> | 2024-01-24 18:59:54 +0900 |
commit | 8e9b074467006c76768efe04cf1fb1ef9d652c67 (patch) | |
tree | fad73c7f94a74c77714c260d1fc0a63e2d205b49 /modules/services/soju.nix | |
download | infra-modules-main.tar.gz infra-modules-main.zip |
Diffstat (limited to 'modules/services/soju.nix')
-rw-r--r-- | modules/services/soju.nix | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/modules/services/soju.nix b/modules/services/soju.nix new file mode 100644 index 0000000..19bb3e6 --- /dev/null +++ b/modules/services/soju.nix @@ -0,0 +1,40 @@ +{ config, lib, ... }: + +with lib; +let + cfg = config.modules.services.soju; +in +{ + options.modules.services.soju = { + enable = mkEnableOption "soju bouncer"; + + hostName = mkOption { type = types.str; default = config.networking.hostName; }; + port = mkOption { type = types.port; default = 6697; }; + tls = { + enable = mkEnableOption "enable TLS encryption"; + acmeHost = mkOption { type = types.str; }; + }; + }; + + config = mkIf cfg.enable { + services.soju = { + enable = true; + hostName = cfg.hostName; + listen = [ ":${toString cfg.port}" ]; + } // optionalAttrs cfg.tls.enable { + tlsCertificate = "${config.security.acme.certs.${cfg.tls.acmeHost}.directory}/cert.pem"; + tlsCertificateKey = "${config.security.acme.certs.${cfg.tls.acmeHost}.directory}/key.pem"; + }; + + systemd.services.soju = { + serviceConfig.SupplementaryGroups = [ "acme" ]; + after = [ "acme-finished-${cfg.tls.acmeHost}.target" ]; + }; + + networking.firewall.allowedTCPPorts = [ cfg.port ]; + + modules.persistence.directories = [ + "/var/lib/private/soju" + ]; + }; +} |