122 lines
3.8 KiB
Nix
122 lines
3.8 KiB
Nix
{ self }:
|
|
{ config, lib, pkgs, ... }:
|
|
let
|
|
inherit (lib) mkEnableOption mkIf mkOption types;
|
|
cfg = config.services.omnisearch;
|
|
generatedConfig = pkgs.writeText "omnisearch-config.ini" ''
|
|
${lib.generators.toINI {} cfg.settings}
|
|
${cfg.extraConfig}
|
|
'';
|
|
assetDir = "${cfg.package}/share/omnisearch";
|
|
in
|
|
{
|
|
options.services.omnisearch = {
|
|
enable = mkEnableOption "OmniSearch metasearch server";
|
|
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
|
|
defaultText = lib.literalExpression "packages.${pkgs.stdenv.hostPlatform.system}.default";
|
|
description = "OmniSearch package to run.";
|
|
};
|
|
|
|
user = mkOption {
|
|
type = types.str;
|
|
default = "omnisearch";
|
|
description = "User account under which OmniSearch runs.";
|
|
};
|
|
|
|
group = mkOption {
|
|
type = types.str;
|
|
default = "omnisearch";
|
|
description = "Group under which OmniSearch runs.";
|
|
};
|
|
|
|
settings = mkOption {
|
|
type = types.attrsOf (types.attrsOf (types.oneOf [ types.str types.int types.bool ]));
|
|
default = {
|
|
server = {
|
|
host = "0.0.0.0";
|
|
port = 8087;
|
|
};
|
|
cache.dir = "/var/cache/omnisearch";
|
|
engines.engines = "*";
|
|
};
|
|
example = {
|
|
server = { host = "127.0.0.1"; port = 8087; };
|
|
engines.engines = "ddg,startpage";
|
|
rate_limit = { search_requests = 10; search_interval = 60; };
|
|
};
|
|
description = ''
|
|
INI settings grouped by section. Section and key names follow
|
|
`example-config.ini`; values are written as strings, integers or
|
|
booleans. The generated INI is stored in the world-readable Nix store,
|
|
so do not put secrets here.
|
|
'';
|
|
};
|
|
|
|
extraConfig = mkOption {
|
|
type = types.lines;
|
|
default = "";
|
|
example = ''
|
|
[proxy]
|
|
proxy = "socks5://127.0.0.1:9050"
|
|
'';
|
|
description = ''
|
|
Additional raw INI text appended after the generated `settings`.
|
|
This text is also embedded in the world-readable Nix store; avoid
|
|
including secrets.
|
|
'';
|
|
};
|
|
|
|
openFirewall = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Whether to open the configured TCP port in the firewall.";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
users.groups.${cfg.group} = {};
|
|
users.users.${cfg.user} = {
|
|
isSystemUser = true;
|
|
group = cfg.group;
|
|
description = "OmniSearch service user";
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
|
|
(cfg.settings.server.port or 8087)
|
|
];
|
|
|
|
systemd.services.omnisearch = {
|
|
description = "OmniSearch metasearch server";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
wants = [ "network-online.target" ];
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = cfg.user;
|
|
Group = cfg.group;
|
|
StateDirectory = "omnisearch";
|
|
CacheDirectory = "omnisearch";
|
|
WorkingDirectory = "/var/lib/omnisearch";
|
|
ExecStartPre = pkgs.writeShellScript "omnisearch-prepare" ''
|
|
ln -sfn ${lib.escapeShellArg "${assetDir}/templates"} templates
|
|
ln -sfn ${lib.escapeShellArg "${assetDir}/static"} static
|
|
ln -sfn ${lib.escapeShellArg "${assetDir}/locales"} locales
|
|
ln -sfn ${lib.escapeShellArg (toString generatedConfig)} config.ini
|
|
'';
|
|
ExecStart = "${cfg.package}/bin/omnisearch";
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
PrivateTmp = true;
|
|
NoNewPrivileges = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
ReadWritePaths = [ "/var/lib/omnisearch" "/var/cache/omnisearch" ];
|
|
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
|
|
};
|
|
};
|
|
};
|
|
}
|