afvalcalendar: Host enschede afvalcalendar

configuration/default.nix

@@ -14,6 +14,7 @@
     "${modulesPath}/profiles/minimal.nix"
     (import ../modules)
 
+    ./services/afvalcalendar.nix
     ./services/backups.nix
     ./services/battery-manager.nix
     ./services/conduit.nix

configuration/services/afvalcalendar.nix

@@ -0,0 +1,67 @@
+{
+  pkgs,
+  config,
+  ...
+}: {
+  systemd.services.afvalcalendar = {
+    description = "Enschede afvalcalendar -> ical converter";
+    wantedBy = ["multi-user.target"];
+    after = ["network.target"];
+
+    script = ''
+      ${pkgs.local.afvalcalendar}/bin/afvalcalendar > /srv/afvalcalendar/afvalcalendar.ical
+    '';
+
+    startAt = "daily";
+
+    serviceConfig = {
+      DynamicUser = true;
+      ProtectHome = true; # Override the default (read-only)
+      PrivateDevices = true;
+      PrivateIPC = true;
+      PrivateUsers = true;
+      ProtectHostname = true;
+      ProtectClock = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectKernelLogs = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
+      RestrictNamespaces = true;
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = ["@system-service" "~@privileged @resources @setuid @keyring"];
+
+      Umask = 0002;
+      SupplementaryGroups = "afvalcalendar-hosting";
+
+      ReadWritePaths = "/srv/afvalcalendar";
+    };
+  };
+
+  services.nginx.virtualHosts."afvalcalendar.${config.services.nginx.domain}" = {
+    forceSSL = true;
+    enableACME = true;
+    enableHSTS = true;
+
+    root = "/srv/afvalcalendar";
+  };
+
+  users.groups.afvalcalendar-hosting = {};
+  systemd.tmpfiles.settings."10-afvalcalendar" = {
+    "/srv/afvalcalendar".d = {
+      user = "nginx";
+      group = "afvalcalendar-hosting";
+      mode = "0775";
+    };
+
+    "/srv/afvalcalendar/afvalcalendar.ical".f = {
+      user = "nginx";
+      group = "afvalcalendar-hosting";
+      mode = "0775";
+    };
+  };
+}