aboutsummaryrefslogtreecommitdiff
path: root/modules
diff options
context:
space:
mode:
Diffstat (limited to 'modules')
-rw-r--r--modules/home-manager/cook-cli/default.nix6
-rw-r--r--modules/home-manager/cook-cli/program.nix14
-rw-r--r--modules/home-manager/cook-cli/service.nix56
-rw-r--r--modules/home-manager/cooklang-chef/default.nix6
-rw-r--r--modules/home-manager/cooklang-chef/program.nix32
-rw-r--r--modules/home-manager/cooklang-chef/service.nix56
-rw-r--r--modules/home-manager/default.nix6
-rw-r--r--modules/nixos/cook-cli.nix118
-rw-r--r--modules/nixos/cooklang-chef.nix130
-rw-r--r--modules/nixos/default.nix5
10 files changed, 429 insertions, 0 deletions
diff --git a/modules/home-manager/cook-cli/default.nix b/modules/home-manager/cook-cli/default.nix
new file mode 100644
index 0000000..f42e210
--- /dev/null
+++ b/modules/home-manager/cook-cli/default.nix
@@ -0,0 +1,6 @@
+{
+ imports = [
+ ./program.nix
+ ./service.nix
+ ];
+}
diff --git a/modules/home-manager/cook-cli/program.nix b/modules/home-manager/cook-cli/program.nix
new file mode 100644
index 0000000..e31187f
--- /dev/null
+++ b/modules/home-manager/cook-cli/program.nix
@@ -0,0 +1,14 @@
+{ config, pkgs, lib, ... }:
+with builtins // lib;
+let
+ cfg = config.programs.cook-cli;
+in {
+ options.programs.cook-cli = {
+ enable = mkEnableOption "cook-cli";
+ package = mkPackageOption pkgs "cook-cli" {};
+ };
+
+ config = mkIf cfg.enable {
+ home.packages = [ cfg.package ];
+ };
+}
diff --git a/modules/home-manager/cook-cli/service.nix b/modules/home-manager/cook-cli/service.nix
new file mode 100644
index 0000000..c4e8083
--- /dev/null
+++ b/modules/home-manager/cook-cli/service.nix
@@ -0,0 +1,56 @@
+{ config, pkgs, lib, ... }:
+with builtins // lib;
+let
+ cfg = config.services.cook-cli;
+ pcfg = config.programs.cook-cli;
+ args = escapeShellArgs ([
+ "--port"
+ (toString cfg.port)
+ ] ++ cfg.extraArgs ++ [
+ cfg.recipeRoot
+ ]);
+in {
+ options.services.cook-cli = {
+ enable = mkEnableOption "cook-cli webserver";
+ package = mkOption {
+ type = types.package;
+ default = pcfg.package;
+ description = ''
+ cook-cli package. It is recommended to set this only in programs.cook-cli
+ '';
+ };
+
+ recipeRoot = mkOption {
+ type = types.path;
+ default = "${config.xdg.dataHome}/cookbook";
+ };
+
+ port = mkOption {
+ type = types.port;
+ defulat = 9080;
+ };
+
+ extraArgs = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+ };
+
+ config = mkIf cfg.enable {
+ systemd.user.services.cook-cli = {
+ Unit = {
+ Description = "A website for serving cooklang cookbooks";
+ After = [ "network.target" ];
+ };
+ Service = {
+ Restart = "on-failure";
+ RestartSec = 10;
+ Type = "simple";
+ ExecStart = "${getExe cfg.package} server ${args}";
+ };
+ Install = {
+ WantedBy = [ "default.target" ];
+ };
+ };
+ };
+}
diff --git a/modules/home-manager/cooklang-chef/default.nix b/modules/home-manager/cooklang-chef/default.nix
new file mode 100644
index 0000000..f42e210
--- /dev/null
+++ b/modules/home-manager/cooklang-chef/default.nix
@@ -0,0 +1,6 @@
+{
+ imports = [
+ ./program.nix
+ ./service.nix
+ ];
+}
diff --git a/modules/home-manager/cooklang-chef/program.nix b/modules/home-manager/cooklang-chef/program.nix
new file mode 100644
index 0000000..4cbed5c
--- /dev/null
+++ b/modules/home-manager/cooklang-chef/program.nix
@@ -0,0 +1,32 @@
+{ config, pkgs, lib, ... }:
+with builtins // lib;
+let
+ cfg = config.programs.cooklang-chef;
+ toml = pkgs.formats.toml {};
+in {
+ options.programs.cooklang-chef = {
+ enable = mkEnableOption "cooklang-chef";
+ package = mkPackageOption pkgs "cooklang-chef" {};
+
+ settings = mkOption {
+ type = toml.type;
+ default = {};
+ description = "https://github.com/Zheoni/cooklang-chef/blob/main/docs/cli.md";
+ };
+
+ };
+
+ config = mkIf cfg.enable {
+ home.packages = [ cfg.package ];
+
+ programs.cooklang-chef.settings = {
+ default_collection = mkDefault "${config.xdg.dataHome}/cookbook";
+ };
+
+ xdg.configFile = {
+ "cooklang-chef/chef-config.toml" = mkIf (cfg.settings != {}) {
+ source = toml.generate "chef-config.toml" cfg.settings;
+ };
+ };
+ };
+}
diff --git a/modules/home-manager/cooklang-chef/service.nix b/modules/home-manager/cooklang-chef/service.nix
new file mode 100644
index 0000000..8a9e34b
--- /dev/null
+++ b/modules/home-manager/cooklang-chef/service.nix
@@ -0,0 +1,56 @@
+{ config, pkgs, lib, ... }:
+with builtins // lib;
+let
+ cfg = config.services.cooklang-chef;
+ pcfg = config.programs.cooklang-chef;
+ args = escapeShellArgs ([
+ "--port"
+ (toString cfg.port)
+ "--path"
+ cfg.recipeRoot
+ ] ++ cfg.extraArgs);
+in {
+ options.services.cooklang-chef = {
+ enable = mkEnableOption "cooklang-chef webserver";
+ package = mkOption {
+ type = types.package;
+ default = pcfg.package;
+ description = ''
+ cooklang-chef package. It is recommended to set this only in programs.cooklang-chef.
+ '';
+ };
+
+ recipeRoot = mkOption {
+ type = types.path;
+ default = pcfg.settings.default_collection or "${config.xdg.dataHome}/cookbook";
+ };
+
+ port = mkOption {
+ type = types.port;
+ default = 9080;
+ };
+
+ extraArgs = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+ };
+
+ config = mkIf cfg.enable {
+ systemd.user.services.cooklang-chef = {
+ Unit = {
+ Description = "A website for serving cooklang cookbooks";
+ After = [ "network.target" ];
+ };
+ Service = {
+ Restart = "on-failure";
+ RestartSec = 10;
+ Type = "simple";
+ ExecStart = "${getExe cfg.package} serve ${args}";
+ };
+ Install = {
+ WantedBy = [ "default.target" ];
+ };
+ };
+ };
+}
diff --git a/modules/home-manager/default.nix b/modules/home-manager/default.nix
new file mode 100644
index 0000000..d4f83da
--- /dev/null
+++ b/modules/home-manager/default.nix
@@ -0,0 +1,6 @@
+{
+ imports = [
+ ./cook-cli
+ ./cooklang-chef
+ ];
+}
diff --git a/modules/nixos/cook-cli.nix b/modules/nixos/cook-cli.nix
new file mode 100644
index 0000000..bfee526
--- /dev/null
+++ b/modules/nixos/cook-cli.nix
@@ -0,0 +1,118 @@
+{ config, pkgs, lib, ... }:
+with builtins // lib;
+let
+ cfg = config.services.cook-cli;
+ args = escapeShellArgs ([
+ "--port"
+ (toString cfg.port)
+ ] ++ cfg.extraArgs ++ [
+ cfg.recipeRoot
+ ]);
+in {
+ options.services.cook-cli = {
+ enable = mkEnableOption "cook-cli webserver";
+ package = mkPackageOption pkgs "cook-cli" {};
+
+ recipeRoot = mkOption {
+ type = types.path;
+ default = "/var/lib/cookbook";
+ };
+
+ user = mkOption {
+ type = types.str;
+ default = "cook-cli";
+ };
+
+ group = mkOption {
+ type = types.str;
+ default = "cook-cli";
+ };
+
+ port = mkOption {
+ type = types.port;
+ default = 9080;
+ };
+
+ extraArgs = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+
+ nginx = {
+ enable = mkEnableOption "nginx reverse proxy";
+ virtualHost = mkOption {
+ type = types.str;
+ example = mdDoc ''
+ cook.example.com
+ '';
+ };
+ location = mkOption {
+ type = types.str;
+ default = "/";
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ users = {
+ users = mkIf (cfg.user == "cook-cli") {
+ ${cfg.user} = {
+ isSystemUser = true;
+ group = cfg.group;
+ };
+ };
+ groups = mkIf (cfg.group == "cook-cli") {
+ ${cfg.group} = {};
+ };
+ };
+
+ systemd.services.cooklang-chef = {
+ description = "A website for serving cooklang cookbooks";
+ after = [ "network.target" ];
+ requires = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+ serviceConfig = {
+ ExecStart = "${getExe cfg.package} server ${args}";
+ User = cfg.user;
+ Group = cfg.group;
+ IPAddressAllow = "localhost";
+ IPAddressDeny = "any";
+ LockPersonality = true;
+ MemoryDenyWriteExecute = true;
+ NoNewPrivileges = true;
+ PrivateDevices = true;
+ PrivateTmp = true;
+ PrivateUsers = true;
+ ProcSubset = "pid";
+ ProtectClock = true;
+ ProtectControlGroups = true;
+ ProtectHome = true;
+ ProtectHostname = true;
+ ProtectKernelLogs = true;
+ ProtectKernelModules = true;
+ ProtectKernelTunables = true;
+ ProtectProc = "invisible";
+ ProtectSystem = "strict";
+ ReadWritePaths = cfg.recipeRoot;
+ RemoveIPC = true;
+ RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+ RestrictNamespaces = true;
+ RestrictRealtime = true;
+ RestrictSUIDSGID = true;
+ SystemCallArchitectures = "native";
+ SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+ UMask = "0027";
+ WorkingDirectory = cfg.recipeRoot;
+ };
+ };
+
+ services.nginx = mkIf cfg.nginx.enable {
+ enable = mkDefault true;
+ virtualHosts.${cfg.nginx.virtualHost} = {
+ locations.${cfg.nginx.location} = {
+ proxyPass = "http://127.0.0.1:${toString cfg.port}";
+ };
+ };
+ };
+ };
+}
diff --git a/modules/nixos/cooklang-chef.nix b/modules/nixos/cooklang-chef.nix
new file mode 100644
index 0000000..65af966
--- /dev/null
+++ b/modules/nixos/cooklang-chef.nix
@@ -0,0 +1,130 @@
+{ config, pkgs, lib, ... }:
+with builtins // lib;
+let
+ cfg = config.services.cooklang-chef;
+ args = escapeShellArgs ([
+ "--port"
+ (toString cfg.port)
+ "--path"
+ cfg.recipeRoot
+ ] ++ cfg.extraArgs);
+in {
+ options.services.cooklang-chef = {
+ enable = mkEnableOption "cooklang-chef webserver";
+ package = mkPackageOption pkgs "cooklang-chef" {};
+
+ recipeRoot = mkOption {
+ type = types.path;
+ default = "${cfg.dataDir}/cookbook";
+ };
+
+ user = mkOption {
+ type = types.str;
+ default = "cooklang-chef";
+ };
+
+ group = mkOption {
+ type = types.str;
+ default = "cooklang-chef";
+ };
+
+ dataDir = mkOption {
+ type = types.path;
+ default = "/var/lib/cooklang-chef";
+ description = ''
+ Home directory for ${cfg.user}.
+ '';
+ };
+
+ port = mkOption {
+ type = types.port;
+ default = 9080;
+ };
+
+ extraArgs = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+
+ nginx = {
+ enable = mkEnableOption "nginx reverse proxy";
+ virtualHost = mkOption {
+ type = types.str;
+ example = mdDoc ''
+ cook.example.com
+ '';
+ };
+ location = mkOption {
+ type = types.str;
+ default = "/";
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ users = {
+ users = mkIf (cfg.user == "cooklang-chef") {
+ ${cfg.user} = {
+ isSystemUser = true;
+ group = cfg.group;
+ home = cfg.dataDir;
+ };
+ };
+ groups = mkIf (cfg.group == "cooklang-chef") {
+ ${cfg.group} = {};
+ };
+ };
+
+ systemd.services.cooklang-chef = {
+ description = "A website for serving cooklang cookbooks";
+ after = [ "network.target" ];
+ requires = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+ unitConfig.RequiresMountsFor = cfg.recipeRoot;
+ serviceConfig = {
+ StateDirectory = "cooklang-chef cooklang-chef/.config";
+ StateDirectoryMode = "0750";
+ ExecStart = "${getExe cfg.package} serve ${args}";
+ User = cfg.user;
+ Group = cfg.group;
+ IPAddressAllow = "localhost";
+ IPAddressDeny = "any";
+ LockPersonality = true;
+ MemoryDenyWriteExecute = true;
+ NoNewPrivileges = true;
+ PrivateDevices = true;
+ PrivateTmp = true;
+ PrivateUsers = true;
+ ProcSubset = "pid";
+ ProtectClock = true;
+ ProtectControlGroups = true;
+ ProtectHome = true;
+ ProtectHostname = true;
+ ProtectKernelLogs = true;
+ ProtectKernelModules = true;
+ ProtectKernelTunables = true;
+ ProtectProc = "invisible";
+ ProtectSystem = "strict";
+ ReadWritePaths = cfg.dataDir;
+ RemoveIPC = true;
+ RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+ RestrictNamespaces = true;
+ RestrictRealtime = true;
+ RestrictSUIDSGID = true;
+ SystemCallArchitectures = "native";
+ SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+ UMask = "0027";
+ WorkingDirectory = cfg.dataDir;
+ };
+ };
+
+ services.nginx = mkIf cfg.nginx.enable {
+ enable = mkDefault true;
+ virtualHosts.${cfg.nginx.virtualHost} = {
+ locations.${cfg.nginx.location} = {
+ proxyPass = "http://127.0.0.1:${toString cfg.port}";
+ };
+ };
+ };
+ };
+}
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
new file mode 100644
index 0000000..d60e5e9
--- /dev/null
+++ b/modules/nixos/default.nix
@@ -0,0 +1,5 @@
+{
+ imports = [
+ ./cooklang-chef.nix
+ ];
+}
generated by cgit v1.2.3 (git 2.25.1) at 2026-07-09 19:05:49 +0000