93 lines
2.3 KiB
Nix
93 lines
2.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.downloadwf;
|
|
in
|
|
{
|
|
options.services.downloadwf = {
|
|
enable = lib.mkEnableOption "the File Drop private file host";
|
|
|
|
user = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "System user that runs the service.";
|
|
};
|
|
|
|
workingDir = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/srv/download";
|
|
description = "Directory containing the code (src/server.ts).";
|
|
};
|
|
|
|
storageDir = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/srv/download/storage";
|
|
description = "Where files and metadata are persisted.";
|
|
};
|
|
|
|
host = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "127.0.0.1";
|
|
description = "Bind address. Use 0.0.0.0 to expose directly.";
|
|
};
|
|
|
|
port = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = 3000;
|
|
description = "Listen port.";
|
|
};
|
|
|
|
maxFileSize = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "5GB";
|
|
description = "Maximum upload size (B/KB/MB/GB/TB).";
|
|
};
|
|
|
|
trustProxy = lib.mkEnableOption "trust of X-Forwarded-* headers (behind a reverse proxy)";
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
systemd.tmpfiles.rules = [
|
|
"d ${cfg.storageDir} 0755 ${cfg.user} ${cfg.user} -"
|
|
];
|
|
|
|
systemd.services.downloadwf = {
|
|
description = "File Drop private file host";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
|
|
path = with pkgs; [ bun ];
|
|
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = cfg.user;
|
|
Group = cfg.user;
|
|
WorkingDirectory = cfg.workingDir;
|
|
Environment = [
|
|
"HOME=/home/${cfg.user}"
|
|
"PORT=${toString cfg.port}"
|
|
"HOST=${cfg.host}"
|
|
"STORAGE_DIR=${cfg.storageDir}"
|
|
"MAX_FILE_SIZE=${cfg.maxFileSize}"
|
|
] ++ lib.optionals cfg.trustProxy [ "TRUST_PROXY=1" ];
|
|
|
|
# no runtime deps, so no `bun install` needed at startup
|
|
ExecStart = "${pkgs.bun}/bin/bun src/server.ts";
|
|
Restart = "on-failure";
|
|
RestartSec = 3;
|
|
TimeoutStopSec = 30;
|
|
|
|
# hardening
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectSystem = "full";
|
|
ProtectHome = true;
|
|
ReadWritePaths = [ cfg.storageDir ];
|
|
};
|
|
};
|
|
};
|
|
} |