1 files changed, 0 insertions, 136 deletions
diff --git a/services/goaccess.nix b/services/goaccess.nix
deleted file mode 100644
index dd6b26d..0000000
--- a/services/goaccess.nix
+++ /dev/null
@@ -1,136 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  inputs,
-  ...
-}: let
-  cfg = config.goaccess;
-in {
-  options."caddy-goaccess" = {
-    timeZone = lib.mkOption {
-      type = lib.types.str;
-      description = "time zone";
-    };
-    logFile = lib.mkOption {
-      type = lib.types.str;
-      description = "caddy log file for goaccess to read (must be chmod 775)";
-    };
-    websocketUrl = lib.mkOption {
-      type = lib.types.str;
-      description = "url that the frontend should use to attach to the service websocket";
-    };
-  };
-  config = let
-    settings = {
-      unix-socket = "/run/caddy-goaccess/socket";
-      ws-url = cfg.websocketUrl;
-
-      date-format = "%s";
-      log-format = "CADDY";
-      tz = cfg.timeZone;
-      log-file = cfg.logFile;
-      geoip-database = inputs.geolite-db;
-
-      output = "/run/caddy-goaccess/index.html";
-      real-time-html = "true";
-      external-assets = "true";
-      all-static-files = "false";
-      html-report-title = "stats@ganymede";
-      hl-header = "true";
-      agent-list = "false";
-      with-output-resolver = "false";
-      http-method = "yes";
-      http-protocol = "yes";
-      "4xx-to-unique-count" = "false";
-      ignore-crawlers = "false";
-      crawlers-only = "false";
-      unknowns-as-crawlers = "false";
-      real-os = "true";
-    };
-  in {
-    configData."goaccess.conf".text = settings |> builtins.mapAttrs (k: v: "${k} ${toString v}") |> builtins.attrValues |> lib.concatStringsSep "\n";
-    services."caddy-goaccess" = {
-      systemd.socket = {
-        description = "caddy-goaccess uds";
-        socketConfig = {
-          ListenStream = "/run/caddy-goaccess/socket";
-          SocketMode = "0660";
-          SocketUser = "goaccess";
-          SocketGroup = "caddy";
-        };
-        wantedBy = ["sockets.target"];
-      };
-
-      systemd.service = {
-        description = "GoAccess Real-Time Log Analyzer";
-        restartIfChanged = true;
-        wants = ["network-online.target" "caddy.service"];
-        after = ["network-online.target" "caddy.service"];
-        requires = ["caddy-goaccess.socket"];
-
-        serviceConfig = {
-          Type = "simple";
-
-          DynamicUser = true;
-          SupplimentaryGroup = "caddy"; # to read caddy log files
-          RuntimeDirectory = "caddy-goaccess"; # /run/caddy-goaccess
-          ExecStart = "${pkgs.goaccess}/bin/goaccess -p ${config.configData."goaccess.conf".path}";
-
-          # hardening stuff
-          AmbientCapabilities = [];
-          CapabilityBoundingSet = [
-            "~CAP_RAWIO"
-            "~CAP_MKNOD"
-            "~CAP_AUDIT_CONTROL"
-            "~CAP_AUDIT_READ"
-            "~CAP_AUDIT_WRITE"
-            "~CAP_SYS_BOOT"
-            "~CAP_SYS_TIME"
-            "~CAP_SYS_MODULE"
-            "~CAP_SYS_PACCT"
-            "~CAP_LEASE"
-            "~CAP_LINUX_IMMUTABLE"
-            "~CAP_IPC_LOCK"
-            "~CAP_BLOCK_SUSPEND"
-            "~CAP_WAKE_ALARM"
-            "~CAP_SYS_TTY_CONFIG"
-            "~CAP_MAC_ADMIN"
-            "~CAP_MAC_OVERRIDE"
-            "~CAP_NET_ADMIN"
-            "~CAP_NET_BROADCAST"
-            "~CAP_NET_RAW"
-            "~CAP_SYS_ADMIN"
-            "~CAP_SYS_PTRACE"
-            "~CAP_SYSLOG"
-          ];
-          DevicePolicy = "closed";
-          KeyringMode = "private";
-          LockPersonality = true;
-          NoNewPrivileges = true;
-          PrivateDevices = true;
-          PrivateMounts = true;
-          PrivateTmp = true;
-          ProtectClock = true;
-          ProtectControlGroups = true;
-          ProtectHome = true;
-          ProtectHostname = true;
-          ProtectKernelLogs = true;
-          ProtectKernelModules = true;
-          ProtectKernelTunables = true;
-          ProtectSystem = "full";
-          RemoveIPC = true;
-          RestrictAddressFamilies = [
-            "AF_UNIX"
-            "AF_INET"
-            "AF_INET6"
-          ];
-          RestrictNamespaces = true;
-          RestrictRealtime = true;
-        };
-
-        wantedBy = ["multi-user.target"];
-      };
-    };
-  };
-}