68 lines
1.7 KiB
Nix
68 lines
1.7 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
...
|
|
}: {
|
|
systemd.services.afvalcalendar = {
|
|
description = "Enschede afvalcalendar -> ical converter";
|
|
wantedBy = ["multi-user.target"];
|
|
after = ["network.target"];
|
|
|
|
script = ''
|
|
${pkgs.local.afvalcalendar}/bin/afvalcalendar > /srv/afvalcalendar/afvalcalendar.ical
|
|
'';
|
|
|
|
startAt = "daily";
|
|
|
|
serviceConfig = {
|
|
DynamicUser = true;
|
|
ProtectHome = true; # Override the default (read-only)
|
|
PrivateDevices = true;
|
|
PrivateIPC = true;
|
|
PrivateUsers = true;
|
|
ProtectHostname = true;
|
|
ProtectClock = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectControlGroups = true;
|
|
RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
|
|
RestrictNamespaces = true;
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallFilter = ["@system-service" "~@privileged @resources @setuid @keyring"];
|
|
|
|
Umask = 0002;
|
|
SupplementaryGroups = "afvalcalendar-hosting";
|
|
|
|
ReadWritePaths = "/srv/afvalcalendar";
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts."afvalcalendar.${config.services.nginx.domain}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
enableHSTS = true;
|
|
|
|
root = "/srv/afvalcalendar";
|
|
};
|
|
|
|
users.groups.afvalcalendar-hosting = {};
|
|
systemd.tmpfiles.settings."10-afvalcalendar" = {
|
|
"/srv/afvalcalendar".d = {
|
|
user = "nginx";
|
|
group = "afvalcalendar-hosting";
|
|
mode = "0775";
|
|
};
|
|
|
|
"/srv/afvalcalendar/afvalcalendar.ical".f = {
|
|
user = "nginx";
|
|
group = "afvalcalendar-hosting";
|
|
mode = "0775";
|
|
};
|
|
};
|
|
}
|