feat(tubesync): add tubesync application and module

2024-02-21 23:25:06 +08:00 · 2024-02-21 23:25:06 +08:00 · 728cf4ad3b
commit 728cf4ad3b
parent f2f2b34e80
5 changed files with 356 additions and 0 deletions
--- a/package/tubesync/nixos.nix
+++ b/package/tubesync/nixos.nix
@ -0,0 +1,172 @@
+{ pkgs
+, lib
+, config
+, ... }: with lib; let
+  cfg = config.services.tubesync;
+in {
+  options.services.tubesync = {
+    enable = mkEnableOption "tubesync stack";
+    debug = mkEnableOption "debug logging";
+    package = mkOption {
+      type = with types; package;
+      default = pkgs.tubesync;
+      description = "tubesync launcher package";
+    };
+
+    user = mkOption {
+      type = with types; str;
+      default = "tubesync";
+      description = "user under which tubesync runs";
+    };
+    group = mkOption {
+      type = with types; str;
+      default = "tubesync";
+      description = "group under which tubesync runs";
+    };
+
+    listen = {
+      host = mkOption {
+        type = with types; str;
+        default = "127.0.0.1";
+        description = "host to listen on";
+      };
+      port = mkOption {
+        type = with types; port;
+        default = 8080;
+        description = "port to listen on";
+      };
+    };
+
+    stateDir = mkOption {
+      type = with types; str;
+      default = "/var/lib/tubesync";
+      description = "path to tubesync state storage directory";
+    };
+
+    dataDir = mkOption {
+      type = with types; str;
+      default = "${cfg.stateDir}/downloads";
+      description = "path to tubesync video downloads";
+    };
+
+    database = mkOption {
+      type = with types; str;
+      default = "postgresql://tubesync:@localhost:5432/tubesync";
+      description = "database connection string";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services = let
+      env = {
+        PYTHONPATH = cfg.package.pythonPath;
+        GUNICORN_PID_FILE = "${cfg.stateDir}/run/gunicorn.pid";
+        GUNICORN_USER = cfg.user;
+        GUNICORN_GROUP = cfg.group;
+        DATABASE_CONNECTION = cfg.database;
+        CONFIG_BASE_DIR = cfg.stateDir;
+        DOWNLOADS_BASE_DIR = cfg.dataDir;
+        TUBESYNC_DEBUG = mkIf cfg.debug "True";
+
+        REDIS_CONNECTION = "redis+socket://"
+        + "${cfg.stateDir}/run/redis.sock";
+      };
+
+      base = description: {
+        description = "tubesync: ${description}";
+        wantedBy = [ "multi-user.target" ];
+        environment = env;
+        path = [ cfg.package ];
+        serviceConfig = {
+          WorkingDirectory = cfg.stateDir;
+          User = cfg.user;
+          Group = cfg.group;
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          PrivateUsers = false;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProcSubset = "all";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          ReadWritePaths = with cfg; [ stateDir dataDir ];
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_NETLINK"
+            "AF_UNIX"
+          ];
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+            "@chown"
+          ];
+          UMask = "0077";
+        };
+      };
+
+      base' = description: (base description) // {
+        after = [ "tubesync.service" ];
+        partOf = [ "tubesync.service" ];
+      };
+    in {
+      tubesync = recursiveUpdate (base "gunicorn") ({
+        after = [ "network.target" ];
+        serviceConfig = {
+          PIDFile = env.GUNICORN_PID_FILE;
+          ExecStartPre = pkgs.writeShellScript "tubesync-setup" ''
+            set -xe
+            tubesync-migrate
+
+            mkdir -p "/tmp/tubesync"
+            cp -r "${cfg.package.app}/static/." "/tmp/tubesync/static"
+            chmod +w -R "/tmp/tubesync/static"
+          '';
+          ExecStart = "${cfg.package}/bin/tubesync-gunicorn";
+          ExecReload = "/usr/bin/env kill -s HUP $MAINPID";
+          ExecStop = "/usr/bin/env kill -s TERM $MAINPID";
+          ExecStopPost = pkgs.writeShellScript "tubesync-cleanup" ''
+            rm -f "$GUNICORN_PID_FILE"
+            rm -rf "/tmp/tubesync"
+          '';
+        };
+      });
+
+      tubesync-worker = recursiveUpdate (base' "worker") ({
+        serviceConfig.ExecStart = "${cfg.package}/bin/tubesync-worker";
+      });
+    };
+
+    services.redis.servers.tubesync-celery = {
+      enable = true;
+      inherit (cfg) user;
+      unixSocket = "${cfg.stateDir}/run/redis.sock";
+      save = [ ];
+    };
+
+    users.users = mkIf (cfg.user == "tubesync") {
+      tubesync = {
+        description = "tubesync service account";
+        group = cfg.group;
+        uid = config.ids.uids.tubesync;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "tubesync") {
+      tubesync.gid = config.ids.gids.tubesync;
+    };
+
+    ids.uids.tubesync = 101;
+    ids.gids.tubesync = 101;
+  };
+}