trust proxy

deploy/nixos/download.nix

@@ -5,10 +5,10 @@
   ...
 }:
 let
-  cfg = config.services.downloadwf;
+  cfg = config.services.download;
 in
 {
-  options.services.downloadwf = {
+  options.services.download = {
     enable = lib.mkEnableOption "the File Drop private file host";
 
     user = lib.mkOption {
@@ -25,7 +25,7 @@ in
     storageDir = lib.mkOption {
       type = lib.types.str;
       default = "/srv/download/storage";
-      description = "Where files and metadata are persisted.";
+      description = "Persistent directory where files and metadata are stored.";
     };
 
     host = lib.mkOption {
@@ -52,7 +52,25 @@ in
       description = "Milliseconds before an uploaded file expires and is deleted.";
     };
 
+    publicBaseUrl = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = "Public domain of the site (e.g. https://files.example.com).";
+    };
+
     trustProxy = lib.mkEnableOption "trust of X-Forwarded-* headers (behind a reverse proxy)";
+
+    repoUrl = lib.mkOption {
+      type = lib.types.str;
+      default = "https://github.com/Kisakay/download.git";
+      description = "Git repository to clone/pull from.";
+    };
+
+    deployOnBoot = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Pull the repo at boot (like the nightcord-deploy pattern).";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -60,11 +78,39 @@ in
       "d ${cfg.storageDir} 0755 ${cfg.user} ${cfg.user} -"
     ];
 
-    systemd.services.downloadwf = {
-      description = "File Drop private file host";
-      wantedBy = [ "multi-user.target" ];
+    systemd.services.download-deploy = {
+      description = "Update download from git";
       after = [ "network-online.target" ];
       wants = [ "network-online.target" ];
+      wantedBy = lib.mkIf cfg.deployOnBoot [ "multi-user.target" ];
+
+      path = with pkgs; [ git bun ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = cfg.user;
+        WorkingDirectory = cfg.workingDir;
+        Environment = [ "HOME=/home/${cfg.user}" ];
+        ExecStartPost = "+${pkgs.systemd}/bin/systemctl restart download.service";
+      };
+
+      script = ''
+        set -euo pipefail
+        if [ ! -d "${cfg.workingDir}/.git" ]; then
+          git clone ${cfg.repoUrl} ${cfg.workingDir}
+        else
+          git -C ${cfg.workingDir} pull --ff-only
+        fi
+        cd ${cfg.workingDir}
+        bun install
+      '';
+    };
+
+    systemd.services.download = {
+      description = "File Drop private file host";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
 
       path = with pkgs; [ bun ];
 
@@ -73,22 +119,23 @@ in
         User = cfg.user;
         Group = cfg.user;
         WorkingDirectory = cfg.workingDir;
-        Environment = [
-          "HOME=/home/${cfg.user}"
-          "PORT=${toString cfg.port}"
-          "HOST=${cfg.host}"
-          "STORAGE_DIR=${cfg.storageDir}"
-          "MAX_FILE_SIZE=${cfg.maxFileSize}"
-          "FILE_TTL_MS=${toString cfg.fileTtlMs}"
-        ] ++ lib.optionals cfg.trustProxy [ "TRUST_PROXY=1" ];
+        Environment =
+          [
+            "HOME=/home/${cfg.user}"
+            "PORT=${toString cfg.port}"
+            "HOST=${cfg.host}"
+            "STORAGE_DIR=${cfg.storageDir}"
+            "MAX_FILE_SIZE=${cfg.maxFileSize}"
+            "FILE_TTL_MS=${toString cfg.fileTtlMs}"
+          ]
+          ++ lib.optionals (cfg.publicBaseUrl != null) [ "PUBLIC_BASE_URL=${cfg.publicBaseUrl}" ]
+          ++ lib.optionals cfg.trustProxy [ "TRUST_PROXY=1" ];
 
-        # no runtime deps, so no `bun install` needed at startup
         ExecStart = "${pkgs.bun}/bin/bun src/server.ts";
         Restart = "on-failure";
         RestartSec = 3;
         TimeoutStopSec = 30;
 
-        # hardening
         NoNewPrivileges = true;
         PrivateTmp = true;
         ProtectSystem = "full";