1
0
Fork 0
dotfiles/system/nixos/rimgo.nix
2023-03-05 19:22:15 +01:00

68 lines
1.6 KiB
Nix

{ pkgs, config, ... }:
let
rimgo-pkg = pkgs.rimgo;
in
{
systemd.services.rimgo = {
description = "An alternative frontend for Imgur";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
serviceConfig = {
DynamicUser = true;
StateDirectory = "rimgo";
Environment = [
"ADDRESS=127.0.0.1"
"PORT=8006"
];
ExecStart = "${rimgo-pkg}/bin/rimgo";
Restart = "on-failure";
RestartSec = "5s";
# Hardening
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
};
services.nginx = {
enable = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedBrotliSettings = true;
virtualHosts."rimgo.only.internal" = {
listen = [
{
addr = "127.0.0.1";
port = 80;
}
];
forceSSL = false;
enableACME = false;
basicAuthFile = config.age.secrets.rimgo-auth.path;
locations."/" = {
recommendedProxySettings = true;
proxyPass = "http://127.0.0.1:8006";
};
};
};
}