144 lines
4.2 KiB
Nix
144 lines
4.2 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
let
|
|
cfg = config.services.pyload;
|
|
|
|
stateDir = "/var/lib/pyload";
|
|
userDir = "${stateDir}/config";
|
|
in
|
|
{
|
|
options = with lib; {
|
|
services.pyload = {
|
|
enable = mkEnableOption "pyload download manager";
|
|
|
|
package = mkPackageOption pkgs "pyload-ng" { };
|
|
|
|
listenAddress = mkOption {
|
|
type = types.str;
|
|
default = "localhost";
|
|
example = "0.0.0.0";
|
|
description = "Address to listen on for the web UI.";
|
|
};
|
|
|
|
port = mkOption {
|
|
type = types.port;
|
|
default = 8000;
|
|
example = 9876;
|
|
description = "Port to listen on for the web UI.";
|
|
};
|
|
|
|
downloadDirectory = mkOption {
|
|
type = types.path;
|
|
default = "${stateDir}/downloads";
|
|
example = "/mnt/downloads";
|
|
description = "Directory to store downloads";
|
|
};
|
|
|
|
credentialsFile = mkOption {
|
|
type = with types; nullOr path;
|
|
default = null;
|
|
example = "/run/secrets/pyload-credentials.env";
|
|
description = ''
|
|
File containing PYLOAD_DEFAULT_USERNAME and PYLOAD_DEFAULT_PASSWORD
|
|
in the format of an EnvironmentFile=, as described by systemd.exec(5).
|
|
|
|
If not given, they default to the username/password combo of
|
|
pyload/pyload.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
systemd.tmpfiles.rules = [
|
|
"d ${cfg.downloadDirectory}"
|
|
];
|
|
|
|
systemd.services.pyload = {
|
|
description = "pyload service";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
|
|
# NOTE: unlike what the documentation says, it looks like `HOME` is not
|
|
# defined with this service definition...
|
|
# Since pyload tries to do the equivalent of `cd ~`, it needs to be able
|
|
# to resolve $HOME, which fails when `RootDirectory` is set.
|
|
# FIXME: check if `SetLoginEnvironment` fixes this issue in version 255
|
|
environment = {
|
|
HOME = stateDir;
|
|
PYLOAD__WEBUI__HOST = cfg.listenAddress;
|
|
PYLOAD__WEBUI__PORT = builtins.toString cfg.port;
|
|
};
|
|
|
|
serviceConfig = {
|
|
# FIXME: use getExe
|
|
ExecStart = "${lib.getExe' cfg.package "pyload"} ${lib.escapeShellArgs [
|
|
"--userdir" userDir
|
|
"--storagedir" cfg.downloadDirectory
|
|
]}";
|
|
|
|
User = "pyload";
|
|
Group = "pyload";
|
|
DynamicUser = true;
|
|
|
|
EnvironmentFile = lib.optional (cfg.credentialsFile != null) cfg.credentialsFile;
|
|
|
|
StateDirectory = "pyload";
|
|
WorkingDirectory = stateDir;
|
|
RuntimeDirectory = "pyload";
|
|
RuntimeDirectoryMode = "0700";
|
|
RootDirectory = "/run/pyload";
|
|
BindReadOnlyPaths = [
|
|
builtins.storeDir # Needed to run the python interpreter
|
|
];
|
|
BindPaths = [
|
|
cfg.downloadDirectory
|
|
];
|
|
|
|
# Hardening options
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
NoNewPrivileges = true;
|
|
PrivateDevices = true;
|
|
PrivateMounts = true;
|
|
PrivateTmp = true;
|
|
PrivateUsers = true;
|
|
ProcSubset = "pid";
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectProc = "invisible";
|
|
ProtectSystem = "strict";
|
|
RemoveIPC = true;
|
|
RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
|
|
UMask = "0002";
|
|
CapabilityBoundingSet = [
|
|
"~CAP_BLOCK_SUSPEND"
|
|
"~CAP_BPF"
|
|
"~CAP_CHOWN"
|
|
"~CAP_IPC_LOCK"
|
|
"~CAP_KILL"
|
|
"~CAP_LEASE"
|
|
"~CAP_LINUX_IMMUTABLE"
|
|
"~CAP_NET_ADMIN"
|
|
"~CAP_SYS_ADMIN"
|
|
"~CAP_SYS_BOOT"
|
|
"~CAP_SYS_CHROOT"
|
|
"~CAP_SYS_NICE"
|
|
"~CAP_SYS_PACCT"
|
|
"~CAP_SYS_PTRACE"
|
|
"~CAP_SYS_RESOURCE"
|
|
"~CAP_SYS_TTY_CONFIG"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|