nixos/flood: init

This commit is contained in:
Thiago Kenji Okada 2024-06-05 15:14:56 -03:00
parent a12b153874
commit 1cfd74809b
5 changed files with 119 additions and 0 deletions

View File

@ -1316,6 +1316,7 @@
./services/system/zram-generator.nix
./services/torrent/deluge.nix
./services/torrent/flexget.nix
./services/torrent/flood.nix
./services/torrent/magnetico.nix
./services/torrent/opentracker.nix
./services/torrent/peerflix.nix

View File

@ -0,0 +1,85 @@
{ config, lib, pkgs, utils, ... }:
let
cfg = config.services.flood;
in
{
meta.maintainers = with lib.maintainers; [ thiagokokada ];
options.services.flood = {
enable = lib.mkEnableOption "flood";
package = lib.mkPackageOption pkgs "flood" { };
openFirewall = lib.mkEnableOption "" // {
description = "Whether to open the firewall for the port in {option}`services.flood.port`.";
};
port = lib.mkOption {
type = lib.types.int;
description = "Port to bind webserver.";
default = 3000;
example = 3001;
};
host = lib.mkOption {
type = lib.types.str;
description = "Host to bind webserver.";
default = "localhost";
example = "::";
};
extraArgs = lib.mkOption {
type = with lib.types; listOf str;
description = "Extra arguments passed to `flood`.";
default = [ ];
example = [ "--baseuri=/" ];
};
};
config = lib.mkIf cfg.enable {
systemd.services.flood = {
description = "A modern web UI for various torrent clients.";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
unitConfig = {
Documentation = "https://github.com/jesec/flood/wiki";
};
serviceConfig = {
Restart = "on-failure";
RestartSec = "3s";
ExecStart = utils.escapeSystemdExecArgs ([
(lib.getExe cfg.package)
"--host"
cfg.host
"--port"
(toString cfg.port)
"--rundir=/var/lib/flood"
] ++ cfg.extraArgs);
CapabilityBoundingSet = [ "" ];
DynamicUser = true;
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
StateDirectory = "flood";
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "@pkey" "~@privileged" ];
};
};
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
cfg.port
];
};
}

View File

@ -328,6 +328,7 @@ in {
firewall-nftables = handleTest ./firewall.nix { nftables = true; };
fish = handleTest ./fish.nix {};
flannel = handleTestOn ["x86_64-linux"] ./flannel.nix {};
flood = handleTest ./flood.nix {};
floorp = handleTest ./firefox.nix { firefoxPackage = pkgs.floorp; };
fluentd = handleTest ./fluentd.nix {};
fluidd = handleTest ./fluidd.nix {};

27
nixos/tests/flood.nix Normal file
View File

@ -0,0 +1,27 @@
import ./make-test-python.nix ({ pkgs, ... }:
let
port = 3001;
in
{
name = "flood";
meta = {
maintainers = with pkgs.lib.maintainers; [ thiagokokada ];
};
nodes.machine = { pkgs, ... }: {
services.flood = {
inherit port;
enable = true;
openFirewall = true;
extraArgs = [ "--baseuri=/" ];
};
};
testScript = /* python */ ''
machine.start()
machine.wait_for_unit("flood.service")
machine.wait_for_open_port(${toString port})
machine.succeed("curl --fail http://localhost:${toString port}")
'';
})

View File

@ -1,6 +1,7 @@
{ lib
, buildNpmPackage
, fetchFromGitHub
, nixosTests
}:
buildNpmPackage rec {
@ -16,6 +17,10 @@ buildNpmPackage rec {
npmDepsHash = "sha256-md76I7W5QQvfbOmk5ODssMtJAVOj8nvaJ2PakEZ8WUA=";
passthru.tests = {
inherit (nixosTests) flood;
};
meta = with lib; {
description = "Modern web UI for various torrent clients with a Node.js backend and React frontend";
homepage = "https://flood.js.org";