experiment with modular services; more unix domain sockets, clean up old code

1 files changed, 137 insertions, 90 deletions

diff --git a/modules/services/nixos/glance.nix b/modules/services/nixos/glance.nix
index 8d305a5..2b7ba0b 100644
--- a/modules/services/nixos/glance.nix
+++ b/modules/services/nixos/glance.nix
@@ -6,111 +6,158 @@
 }: let
   cfg = config.collinux.services.glance;
 
-  servicesLinks = builtins.attrValues cfg.homelabServices;
-
-  settings = {
-    server = {
-      inherit (cfg) port;
-      proxied = true;
-      host = "127.0.0.1";
-      assets-path = "/var/lib/glance";
+  modularService = {
+    lib,
+    config,
+    options,
+    ...
+  }: let
+    cfg = config.glance;
+  in {
+    options.glance = {
+      package = lib.mkOption {
+        description = "the `glance` package";
+        type = lib.types.package;
+      };
+      settings = lib.mkOption {
+        description = "glance configuration file contents";
+        type = (pkgs.formats.json {}).type;
+      };
     };
-
-    branding.hide-footer = true;
-    pages = [
+    config =
       {
-        name = "Dashboard";
-        width = "slim";
-        hide-desktop-navigation = true;
-        center-vertically = true;
-        columns = [
+        configData."config.yml".text = builtins.toJSON (
           {
-            size = "full";
-            widgets = [
-              {
-                type = "search";
-                autofocus = true;
-                search-engine = "duckduckgo";
-                bangs = [
-                  {
-                    title = "GitHub";
-                    shortcut = "gh";
-                    url = "https://github.com/search?q={QUERY}&type=repositories";
-                  }
-                  {
-                    title = "I'm Feeling Lucky";
-                    shortcut = "!";
-                    url = "https://www.google.com/search?q={QUERY}&btnI=&sourceid=navclient&gfns=1";
-                  }
-                  {
-                    title = "YouTube Music";
-                    shortcut = "ytm";
-                    url = "https://music.youtube.com/search?q={QUERY}";
-                  }
-                  {
-                    title = "Google AI Mode";
-                    shortcut = "ai";
-                    url = "https://www.google.com/search?udm=50&q={QUERY}";
-                  }
-                ];
-              }
-              {
-                type = "server-stats";
-                servers = [
-                  {
-                    type = "local";
-                    name = "ganymede";
-                    hide-mountpoints-by-default = true;
-                    mountpoints = {
-                      "/".hide = false;
-                      "/media".hide = false;
-                    };
-                  }
-                ];
-              }
-              {
-                type = "monitor";
-                cache = "1m";
-                title = "Services";
-                sites = servicesLinks;
-              }
-            ];
+            server = {
+              port = 8080;
+              proxied = true;
+              host = "127.0.0.1";
+              assets-path = "/var/lib/glance";
+            };
           }
-        ];
+          // cfg.settings
+        );
+        process.argv = [(lib.getExe cfg.package) "-config" config.configData."config.yml".path];
       }
-    ];
-  };
+      // lib.optionalAttrs (options ? systemd) {
+        systemd.service = {
+          wantedBy = ["multi-user.target"];
 
-  settingsFile = (pkgs.formats.yaml {}).generate "config.yml" settings;
-in {
-  config = lib.mkIf cfg.enable {
-    systemd.services."glance" = {
-      restartIfChanged = true;
-      wants = ["network-online.target"];
-      after = ["network-online.target"];
-      wantedBy = ["multi-user.target"];
+          serviceConfig = {
+            DynamicUser = true;
+            StateDirectory = "glance";
 
-      serviceConfig = {
-        Type = "simple";
+            PrivateNetwork = true;
+            NoNewPrivileges = true;
+            PrivateTmp = true;
+            ProtectSystem = "strict";
+            ProtectHome = true;
+            ProtectKernelTunables = true;
+            ProtectKernelModules = true;
+            ProtectControlGroups = true;
+          };
+        };
 
-        DynamicUser = true;
-        StateDirectory = "glance";
+        systemd.sockets."glance-proxy" = {
+          wantedBy = ["sockets.target"];
+          listenStreams = ["/run/glance/glance.sock"];
+          socketConfig = {
+            SocketMode = "0660";
+            SocketGroup = "caddy";
+          };
+        };
 
-        ExecStart = "${lib.getExe pkgs.glance} -config ${settingsFile}";
+        systemd.services."glance-proxy" = {
+          requires = ["glance.service"];
+          after = ["glance.service"];
+          unitConfig.JoinsNamespaceOf = "glance.service";
 
-        NoNewPrivileges = true;
-        PrivateTmp = true;
-        ProtectSystem = "strict";
-        ProtectHome = true;
-        ProtectKernelTunables = true;
-        ProtectKernelModules = true;
-        ProtectControlGroups = true;
+          serviceConfig = {
+            ExecStart = "${pkgs.systemd}/lib/systemd/systemd-socket-proxyd 127.0.0.1:8080";
+            DynamicUser = true;
+            PrivateNetwork = true;
+            PrivateTmp = true;
+            NoNewPrivileges = true;
+            ProtectSystem = "strict";
+            ProtectHome = true;
+          };
+        };
+      };
+  };
+in {
+  config = lib.mkIf cfg.enable {
+    system.services."glance" = {
+      imports = [modularService];
+      glance = {
+        package = pkgs.glance;
+        settings = let
+          servicesLinks = builtins.attrValues cfg.homelabServices;
+          wrap = x: [x];
+        in {
+          branding.hide-footer = true;
+          pages = wrap {
+            name = "Dashboard";
+            width = "slim";
+            hide-desktop-navigation = true;
+            center-vertically = true;
+            columns = wrap {
+              size = "full";
+              widgets = [
+                {
+                  type = "search";
+                  autofocus = true;
+                  search-engine = "duckduckgo";
+                  bangs = [
+                    {
+                      title = "GitHub";
+                      shortcut = "gh";
+                      url = "https://github.com/search?q={QUERY}&type=repositories";
+                    }
+                    {
+                      title = "I'm Feeling Lucky";
+                      shortcut = "!";
+                      url = "https://www.google.com/search?q={QUERY}&btnI=&sourceid=navclient&gfns=1";
+                    }
+                    {
+                      title = "YouTube Music";
+                      shortcut = "ytm";
+                      url = "https://music.youtube.com/search?q={QUERY}";
+                    }
+                    {
+                      title = "Google AI Mode";
+                      shortcut = "ai";
+                      url = "https://www.google.com/search?udm=50&q={QUERY}";
+                    }
+                  ];
+                }
+                {
+                  type = "server-stats";
+                  servers = wrap {
+                    type = "local";
+                    name = "ganymede";
+                    hide-mountpoints-by-default = true;
+                    mountpoints = {
+                      "/".hide = false;
+                      "/media".hide = false;
+                    };
+                  };
+                }
+                {
+                  type = "monitor";
+                  cache = "1m";
+                  title = "Services";
+                  sites = servicesLinks;
+                }
+              ];
+            };
+          };
+        };
       };
     };
 
     services.caddy.virtualHosts."home.ganymede".extraConfig = ''
       tls internal
-      reverse_proxy 127.0.0.1:${toString cfg.port}
+      reverse_proxy unix///run/glance/glance.sock
     '';
   };
 }