257 lines
8.0 KiB
Nix
257 lines
8.0 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.download;
|
|
|
|
# ---- Backend: Rust binary built with nixpkgs cargo hooks (offline-safe). ----
|
|
filehostBackend = pkgs.rustPlatform.buildRustPackage {
|
|
pname = "filehost";
|
|
version = "1.0.0";
|
|
|
|
# The repository root (backend/ + frontend/). `cargoRoot` points the build
|
|
# at backend/Cargo.toml while keeping the rest of the tree available.
|
|
src = cfg.src;
|
|
cargoRoot = "backend";
|
|
|
|
# Build/test from the backend/ subdirectory. `cargoRoot` locates the
|
|
# Cargo.lock/vendor, `buildAndTestSubdir` points cargo at backend/Cargo.toml.
|
|
buildAndTestSubdir = "backend";
|
|
|
|
# Derive the dependency hash automatically from the checked-in
|
|
# backend/Cargo.lock (version 4; all deps are crates.io registry entries, so
|
|
# no extra outputHashes are needed). No manual cargoHash to maintain.
|
|
cargoLock.lockFile = "${cfg.src}/backend/Cargo.lock";
|
|
|
|
buildInputs = [ ];
|
|
nativeBuildInputs = with pkgs; [ ];
|
|
|
|
# We only need the binary; disable tests to keep the closure small.
|
|
doCheck = false;
|
|
};
|
|
|
|
# ---- Frontend: Svelte static assets built with node/npm. ----
|
|
filehostFrontend = pkgs.buildNpmPackage {
|
|
pname = "filehost-frontend";
|
|
version = "1.0.0";
|
|
|
|
# Build from the frontend/ subdirectory (contains package.json + lock).
|
|
src = "${cfg.src}/frontend";
|
|
|
|
# Hash of the npm dependency fetch (generated from frontend/package-lock.json).
|
|
npmDepsHash = "sha256-ec2rDPuTIGOMdx7oHq+At1Fez6WFCVnFaYydzVF+5Ws=";
|
|
|
|
# The default npm build script is `build` (vite build).
|
|
npmBuildScript = "build";
|
|
|
|
installPhase = ''
|
|
runHook preInstall
|
|
mkdir -p $out/share/filehost
|
|
cp -r dist $out/share/filehost/dist
|
|
runHook postInstall
|
|
'';
|
|
};
|
|
in
|
|
{
|
|
options.services.download = {
|
|
enable = lib.mkEnableOption "the File Drop private file host";
|
|
|
|
# The source tree (backend/ + frontend/) the package is built from. Provide
|
|
# a flake-local path (e.g. `src = ./.` or a `fetchFromGitHub` result) so the
|
|
# build stays pure and reproducible.
|
|
src = lib.mkOption {
|
|
type = lib.types.path;
|
|
description = "Path to the download source tree (backend/ + frontend/).";
|
|
};
|
|
|
|
user = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "filehost";
|
|
description = "System user that runs the service.";
|
|
};
|
|
|
|
group = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "filehost";
|
|
description = "System group that runs the service.";
|
|
};
|
|
|
|
storageDir = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/srv/download/storage";
|
|
description = "Persistent directory where files and metadata are stored.";
|
|
};
|
|
|
|
host = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "127.0.0.1";
|
|
description = "Bind address. Use 0.0.0.0 to expose directly.";
|
|
};
|
|
|
|
port = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = 3000;
|
|
description = "Listen port.";
|
|
};
|
|
|
|
maxFileSize = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "10GB";
|
|
description = "Maximum upload size (B/KB/MB/GB/TB).";
|
|
};
|
|
|
|
fileTtlMs = lib.mkOption {
|
|
type = lib.types.ints.positive;
|
|
default = 48 * 60 * 60 * 1000;
|
|
description = "Milliseconds before an uploaded file expires and is deleted (hard-capped at 48 hours).";
|
|
};
|
|
|
|
maxStorageUsage = lib.mkOption {
|
|
type = lib.types.float;
|
|
default = 0.5;
|
|
description = "Maximum fraction (0.0-1.0) of the storage filesystem that may be used; uploads are rejected above this.";
|
|
};
|
|
|
|
keyLength = lib.mkOption {
|
|
type = lib.types.ints.between 4 64;
|
|
default = 8;
|
|
description = "Length in characters of the upload/download key token (a-z0-9).";
|
|
};
|
|
|
|
publicBaseUrl = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
default = null;
|
|
description = "Public domain of the site (e.g. https://files.example.com).";
|
|
};
|
|
|
|
rateLimitEnabled = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = "Per-IP rate limiting on download/delete/auth endpoints.";
|
|
};
|
|
|
|
rateLimitMax = lib.mkOption {
|
|
type = lib.types.ints.positive;
|
|
default = 300;
|
|
description = "Max requests per rate-limit window.";
|
|
};
|
|
|
|
rateLimitWindowMs = lib.mkOption {
|
|
type = lib.types.ints.positive;
|
|
default = 60000;
|
|
description = "Rate-limit window in milliseconds.";
|
|
};
|
|
|
|
trustProxy = lib.mkEnableOption "trust of X-Forwarded-* headers (behind a reverse proxy)";
|
|
|
|
stripMetadata = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = "Strip embedded EXIF/GPS/author/comments and video metadata server-side.";
|
|
};
|
|
|
|
repoUrl = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "https://github.com/Kisakay/download.git";
|
|
description = "Git repository to clone/pull from.";
|
|
};
|
|
|
|
workingDir = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/srv/download";
|
|
description = "Directory containing the code.";
|
|
};
|
|
|
|
deployOnBoot = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = "Pull the repo at boot and rebuild (like the nightcord-deploy pattern).";
|
|
};
|
|
|
|
rebuildCommand = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "${config.system.build.nixos-rebuild}";
|
|
description = "Command (run as root) to apply the pulled code after a boot deploy. Defaults to the system's own rebuild script (switch without re-evaluating the flake).";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
systemd.tmpfiles.rules = [
|
|
"d ${cfg.storageDir} 0755 ${cfg.user} ${cfg.user} -"
|
|
"d ${cfg.workingDir} 0755 ${cfg.user} ${cfg.user} -"
|
|
];
|
|
|
|
systemd.services.download-deploy = {
|
|
description = "Update download from git and rebuild";
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
wantedBy = lib.mkIf cfg.deployOnBoot [ "multi-user.target" ];
|
|
|
|
path = with pkgs; [ git ];
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
# Rebuild requires root (updates /run/current-system, generations, etc.).
|
|
WorkingDirectory = cfg.workingDir;
|
|
};
|
|
|
|
script = ''
|
|
set -euo pipefail
|
|
if [ ! -d "${cfg.workingDir}/.git" ]; then
|
|
git clone ${cfg.repoUrl} ${cfg.workingDir}
|
|
else
|
|
git -C ${cfg.workingDir} pull --ff-only
|
|
fi
|
|
|
|
# Apply the freshly-pulled code via a rebuild. The built binary comes
|
|
# from `services.download.src` (flake) and is rebuilt by this command.
|
|
${cfg.rebuildCommand}
|
|
'';
|
|
};
|
|
|
|
systemd.services.download = {
|
|
description = "File Drop private file host";
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = cfg.user;
|
|
Group = cfg.group;
|
|
Environment = [
|
|
"HOST=${cfg.host}"
|
|
"PORT=${toString cfg.port}"
|
|
"STORAGE_DIR=${cfg.storageDir}"
|
|
"STATIC_DIR=${filehostFrontend}/share/filehost/dist"
|
|
"MAX_FILE_SIZE=${cfg.maxFileSize}"
|
|
"FILE_TTL_MS=${toString cfg.fileTtlMs}"
|
|
"MAX_STORAGE_USAGE=${toString cfg.maxStorageUsage}"
|
|
"KEY_LENGTH=${toString cfg.keyLength}"
|
|
"RATE_LIMIT_ENABLED=${if cfg.rateLimitEnabled then "1" else "0"}"
|
|
"RATE_LIMIT_MAX=${toString cfg.rateLimitMax}"
|
|
"RATE_LIMIT_WINDOW_MS=${toString cfg.rateLimitWindowMs}"
|
|
"STRIP_METADATA=${if cfg.stripMetadata then "1" else "0"}"
|
|
]
|
|
++ lib.optionals (cfg.publicBaseUrl != null) [ "PUBLIC_BASE_URL=${cfg.publicBaseUrl}" ]
|
|
++ lib.optionals cfg.trustProxy [ "TRUST_PROXY=1" ];
|
|
|
|
ExecStart = "${filehostBackend}/bin/filehost";
|
|
|
|
Restart = "on-failure";
|
|
RestartSec = 3;
|
|
TimeoutStopSec = 30;
|
|
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectSystem = "full";
|
|
ProtectHome = true;
|
|
ReadWritePaths = [ cfg.storageDir ];
|
|
};
|
|
};
|
|
};
|
|
}
|