3 files changed, 82 insertions, 0 deletions
diff --git a/modules/services/nixos/copilot-api.nix b/modules/services/nixos/copilot-api.nix
new file mode 100644
index 0000000..d9d4da3
--- /dev/null
+++ b/modules/services/nixos/copilot-api.nix
@@ -0,0 +1,62 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.collinux.services.copilot-api;
+in {
+  config = lib.mkIf cfg.enable {
+    users.groups."copilot-api" = {};
+    users.users."copilot-api" = {
+      isSystemUser = true;
+      group = "copilot-api";
+      home = "/var/lib/copilot-api";
+      createHome = true;
+    };
+
+    systemd.services."copilot-api" = {
+      description = "GitHub Copilot API Proxy";
+      restartIfChanged = true;
+      wants = ["network-online.target"];
+      after = ["network-online.target"];
+      wantedBy = ["multi-user.target"];
+
+      serviceConfig = {
+        User = "copilot-api";
+        Group = "copilot-api";
+        Type = "simple";
+        Restart = "on-failure";
+        RestartSec = "5s";
+
+        # Load environment variables from file (e.g., GH_TOKEN)
+        EnvironmentFile = lib.mkIf (cfg.githubToken != null) cfg.githubToken;
+
+        # Security hardening
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        RestrictSUIDSGID = true;
+
+        # Allow writing to state directory
+        StateDirectory = "copilot-api";
+        WorkingDirectory = "/var/lib/copilot-api";
+
+        ExecStart = let
+          copilot-api = pkgs.callPackage ../../../pkgs/copilot-api {};
+          # Use bash to read token from environment and pass to command
+          startScript = pkgs.writeShellScript "copilot-api-start" ''
+            exec ${copilot-api}/bin/copilot-api start \
+              --port ${toString cfg.port} \
+              --host ${cfg.listenAddr} \
+              ${lib.optionalString (cfg.githubToken != null) "--github-token \"$GH_TOKEN\""}
+          '';
+        in "${startScript}";
+      };
+    };
+  };
+}
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index d0e170c..3533908 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -15,5 +15,6 @@
     ./minecraft.nix
     ./copyparty.nix
     ./qbittorrent.nix
+    ./copilot-api.nix
   ];
 }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 5744471..17a4e6b 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -164,5 +164,24 @@ in {
         example = "/run/secrets.d/caddy-env";
       };
     };
+
+    copilot-api = {
+      enable = mkEnableOption "GitHub Copilot API proxy";
+      listenAddr = mkOption {
+        description = "Address to listen on";
+        type = ipAddr;
+        default = "127.0.0.1";
+      };
+      port = mkOption {
+        description = "Port to listen on";
+        type = types.port;
+        default = 4141;
+      };
+      githubToken = mkOption {
+        description = "Path to file containing GitHub token";
+        type = types.nullOr types.str;
+        default = null;
+      };
+    };
   };
 }