Update download.nix

deploy/nixos/download.nix

@@ -6,20 +6,77 @@
 }:
 let
   cfg = config.services.download;
+
+  # ---- Backend: Rust binary built with nixpkgs cargo hooks (offline-safe). ----
+  filehostBackend = pkgs.rustPlatform.buildRustPackage {
+    pname = "filehost";
+    version = "1.0.0";
+
+    # The repository root (backend/ + frontend/). `cargoRoot` points the build
+    # at backend/Cargo.toml while keeping the rest of the tree available.
+    src = cfg.src;
+    cargoRoot = "backend";
+
+    # Build/test from the backend/ subdirectory. `cargoRoot` locates the
+    # Cargo.lock/vendor, `buildAndTestSubdir` points cargo at backend/Cargo.toml.
+    buildAndTestSubdir = "backend";
+
+    # Derive the dependency hash automatically from the checked-in
+    # backend/Cargo.lock (version 4; all deps are crates.io registry entries, so
+    # no extra outputHashes are needed). No manual cargoHash to maintain.
+    cargoLock.lockFile = "${cfg.src}/backend/Cargo.lock";
+
+    buildInputs = [ ];
+    nativeBuildInputs = with pkgs; [ ];
+
+    # We only need the binary; disable tests to keep the closure small.
+    doCheck = false;
+  };
+
+  # ---- Frontend: Svelte static assets built with node/npm. ----
+  filehostFrontend = pkgs.buildNpmPackage {
+    pname = "filehost-frontend";
+    version = "1.0.0";
+
+    # Build from the frontend/ subdirectory (contains package.json + lock).
+    src = "${cfg.src}/frontend";
+
+    # Hash of the npm dependency fetch (generated from frontend/package-lock.json).
+    npmDepsHash = "sha256-ec2rDPuTIGOMdx7oHq+At1Fez6WFCVnFaYydzVF+5Ws=";
+
+    # The default npm build script is `build` (vite build).
+    npmBuildScript = "build";
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/share/filehost
+      cp -r dist $out/share/filehost/dist
+      runHook postInstall
+    '';
+  };
 in
 {
   options.services.download = {
     enable = lib.mkEnableOption "the File Drop private file host";
 
+    # The source tree (backend/ + frontend/) the package is built from. Provide
+    # a flake-local path (e.g. `src = ./.` or a `fetchFromGitHub` result) so the
+    # build stays pure and reproducible.
+    src = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to the download source tree (backend/ + frontend/).";
+    };
+
     user = lib.mkOption {
       type = lib.types.str;
+      default = "filehost";
       description = "System user that runs the service.";
     };
 
-    workingDir = lib.mkOption {
+    group = lib.mkOption {
       type = lib.types.str;
-      default = "/srv/download";
-      description = "Directory containing the code (src/server.ts).";
+      default = "filehost";
+      description = "System group that runs the service.";
     };
 
     storageDir = lib.mkOption {
@@ -59,9 +116,9 @@ in
     };
 
     keyLength = lib.mkOption {
-      type = lib.types.ints.positive;
+      type = lib.types.ints.between 4 64;
       default = 8;
-      description = "Length in characters of the upload/download key token.";
+      description = "Length in characters of the upload/download key token (a-z0-9).";
     };
 
     publicBaseUrl = lib.mkOption {
@@ -70,51 +127,95 @@ in
       description = "Public domain of the site (e.g. https://files.example.com).";
     };
 
+    rateLimitEnabled = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Per-IP rate limiting on download/delete/auth endpoints.";
+    };
+
+    rateLimitMax = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 300;
+      description = "Max requests per rate-limit window.";
+    };
+
+    rateLimitWindowMs = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 60000;
+      description = "Rate-limit window in milliseconds.";
+    };
+
     trustProxy = lib.mkEnableOption "trust of X-Forwarded-* headers (behind a reverse proxy)";
 
+    stripMetadata = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Strip embedded EXIF/GPS/author/comments and video metadata server-side.";
+    };
+
     repoUrl = lib.mkOption {
       type = lib.types.str;
       default = "https://github.com/Kisakay/download.git";
       description = "Git repository to clone/pull from.";
     };
 
+    workingDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/srv/download";
+      description = "Directory containing the code.";
+    };
+
     deployOnBoot = lib.mkOption {
       type = lib.types.bool;
       default = true;
-      description = "Pull the repo at boot (like the nightcord-deploy pattern).";
+      description = "Pull the repo at boot and rebuild (like the nightcord-deploy pattern).";
+    };
+
+    rebuildCommand = lib.mkOption {
+      type = lib.types.str;
+      default = "${config.system.build.nixos-rebuild}";
+      description = "Command (run as root) to apply the pulled code after a boot deploy. Defaults to the system's own rebuild script (switch without re-evaluating the flake).";
     };
   };
 
   config = lib.mkIf cfg.enable {
     systemd.tmpfiles.rules = [
       "d ${cfg.storageDir} 0755 ${cfg.user} ${cfg.user} -"
+      "d ${cfg.workingDir} 0755 ${cfg.user} ${cfg.user} -"
     ];
 
     systemd.services.download-deploy = {
-      description = "Update download from git";
+      description = "Update download from git and rebuild";
       after = [ "network-online.target" ];
       wants = [ "network-online.target" ];
       wantedBy = lib.mkIf cfg.deployOnBoot [ "multi-user.target" ];
 
-      path = with pkgs; [ git bun ];
+      path = with pkgs; [ git ];
 
       serviceConfig = {
         Type = "oneshot";
-        User = cfg.user;
+        # Rebuild requires root (updates /run/current-system, generations, etc.).
         WorkingDirectory = cfg.workingDir;
-        Environment = [ "HOME=/home/${cfg.user}" ];
-        ExecStartPost = "+${pkgs.systemd}/bin/systemctl restart download.service";
       };
 
       script = ''
         set -euo pipefail
+
+        # The service runs as root but the checkout is owned by another user;
+        # allow git to operate on it without a persistent global config.
+        export GIT_CONFIG_COUNT=1
+        export GIT_CONFIG_KEY_0=safe.directory
+        export GIT_CONFIG_VALUE_0="${cfg.workingDir}"
+
         if [ ! -d "${cfg.workingDir}/.git" ]; then
           git clone ${cfg.repoUrl} ${cfg.workingDir}
         else
           git -C ${cfg.workingDir} pull --ff-only
         fi
-        cd ${cfg.workingDir}
-        bun install
+
+        # Apply the freshly-pulled code via a rebuild. The built binary comes
+        # from `services.download.src` (flake) and is rebuilt by this command.
+        ${cfg.rebuildCommand}
       '';
     };
 
@@ -124,28 +225,29 @@ in
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      path = with pkgs; [ bun ];
-
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
-        Group = cfg.user;
-        WorkingDirectory = cfg.workingDir;
-        Environment =
-          [
-            "HOME=/home/${cfg.user}"
-            "PORT=${toString cfg.port}"
+        Group = cfg.group;
+        Environment = [
           "HOST=${cfg.host}"
+          "PORT=${toString cfg.port}"
           "STORAGE_DIR=${cfg.storageDir}"
+          "STATIC_DIR=${filehostFrontend}/share/filehost/dist"
           "MAX_FILE_SIZE=${cfg.maxFileSize}"
           "FILE_TTL_MS=${toString cfg.fileTtlMs}"
           "MAX_STORAGE_USAGE=${toString cfg.maxStorageUsage}"
           "KEY_LENGTH=${toString cfg.keyLength}"
+          "RATE_LIMIT_ENABLED=${if cfg.rateLimitEnabled then "1" else "0"}"
+          "RATE_LIMIT_MAX=${toString cfg.rateLimitMax}"
+          "RATE_LIMIT_WINDOW_MS=${toString cfg.rateLimitWindowMs}"
+          "STRIP_METADATA=${if cfg.stripMetadata then "1" else "0"}"
         ]
         ++ lib.optionals (cfg.publicBaseUrl != null) [ "PUBLIC_BASE_URL=${cfg.publicBaseUrl}" ]
         ++ lib.optionals cfg.trustProxy [ "TRUST_PROXY=1" ];
 
-        ExecStart = "${pkgs.bun}/bin/bun src/server.ts";
+        ExecStart = "${filehostBackend}/bin/filehost";
+
         Restart = "on-failure";
         RestartSec = 3;
         TimeoutStopSec = 30;