1
0
Fork 0
dotfiles/system/nixos/rimgo.nix

58 lines
1.4 KiB
Nix
Raw Normal View History

2023-03-05 18:22:15 +00:00
{ pkgs, config, ... }:
let
rimgo-pkg = pkgs.rimgo;
in
{
systemd.services.rimgo = {
description = "An alternative frontend for Imgur";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
serviceConfig = {
DynamicUser = true;
StateDirectory = "rimgo";
Environment = [
"ADDRESS=127.0.0.1"
"PORT=8006"
];
ExecStart = "${rimgo-pkg}/bin/rimgo";
Restart = "on-failure";
RestartSec = "5s";
# Hardening
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
};
services.nginx = {
2023-03-06 08:55:28 +00:00
virtualHosts."ringo.daniel.sx" = {
2023-03-06 09:21:34 +00:00
http3 = true;
2023-03-06 08:55:28 +00:00
forceSSL = true;
useACMEHost = "daniel.sx";
2023-03-05 18:22:15 +00:00
basicAuthFile = config.age.secrets.rimgo-auth.path;
locations."/" = {
recommendedProxySettings = true;
proxyPass = "http://127.0.0.1:8006";
};
};
};
}