Hello :3

2026-08-15 00:40:20 +02:00
parent d8b9fbe993
commit 12854202ca
4 changed files with 101 additions and 16 deletions
@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.downloadwf;
+in
+{
+  options.services.downloadwf = {
+    enable = lib.mkEnableOption "the File Drop private file host";
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      description = "System user that runs the service.";
+    };
+
+    workingDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/srv/download";
+      description = "Directory containing the code (src/server.ts).";
+    };
+
+    storageDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/srv/download/storage";
+      description = "Where files and metadata are persisted.";
+    };
+
+    host = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "Bind address. Use 0.0.0.0 to expose directly.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 3000;
+      description = "Listen port.";
+    };
+
+    maxFileSize = lib.mkOption {
+      type = lib.types.str;
+      default = "5GB";
+      description = "Maximum upload size (B/KB/MB/GB/TB).";
+    };
+
+    trustProxy = lib.mkEnableOption "trust of X-Forwarded-* headers (behind a reverse proxy)";
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.tmpfiles.rules = [
+      "d ${cfg.storageDir} 0755 ${cfg.user} ${cfg.user} -"
+    ];
+
+    systemd.services.downloadwf = {
+      description = "File Drop private file host";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+
+      path = with pkgs; [ bun ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.user;
+        WorkingDirectory = cfg.workingDir;
+        Environment = [
+          "HOME=/home/${cfg.user}"
+          "PORT=${toString cfg.port}"
+          "HOST=${cfg.host}"
+          "STORAGE_DIR=${cfg.storageDir}"
+          "MAX_FILE_SIZE=${cfg.maxFileSize}"
+        ] ++ lib.optionals cfg.trustProxy [ "TRUST_PROXY=1" ];
+
+        # no runtime deps, so no `bun install` needed at startup
+        ExecStart = "${pkgs.bun}/bin/bun src/server.ts";
+        Restart = "on-failure";
+        RestartSec = 3;
+        TimeoutStopSec = 30;
+
+        # hardening
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectSystem = "full";
+        ProtectHome = true;
+        ReadWritePaths = [ cfg.storageDir ];
+      };
+    };
+  };
+}