nix

soju.nix (6521B)

---

 {
   config,
   lib,
   pkgs,
   haravara,
   ...
 }: let
   cfg = config.services.haravara.soju;
 
   # Define the paths for the TLS cert and key.
   # We prefer systemd credentials which are populated from Caddy's certs.
   certPath =
     if cfg.acme.enable
     then "/run/credentials/soju.service/cert.pem"
     else cfg.tlsCertificate;
   keyPath =
     if cfg.acme.enable
     then "/run/credentials/soju.service/key.pem"
     else cfg.tlsCertificateKey;
 
   configFile = pkgs.writeText "soju.conf" ''
     listen ${lib.concatStringsSep "\nlisten " cfg.listen}
     ${lib.optionalString cfg.adminSocket.enable "listen unix+admin://${cfg.runtimeDir}/admin"}
     hostname ${cfg.hostName}
     ${lib.optionalString (certPath != null) "tls ${certPath} ${keyPath}"}
     ${lib.optionalString cfg.enableMessageLogging "message-store fs ${cfg.stateDir}/logs"}
     http-origin ${lib.concatStringsSep " " cfg.httpOrigins}
     accept-proxy-ip ${lib.concatStringsSep " " cfg.acceptProxyIP}
 
     ${cfg.extraConfig}
   '';
 
   sojuctl = pkgs.writeShellScriptBin "sojuctl" ''
     exec ${lib.getExe' cfg.package "sojuctl"} --config ${configFile} "$@"
   '';
 
   # Path to Caddy's certificates
   caddyCertDir = "${cfg.acme.caddyCertDir}/${cfg.domain}";
 in {
   options.services.haravara.soju = {
     enable = lib.mkEnableOption "soju IRC bouncer";
 
     package = lib.mkPackageOption pkgs "soju" {};
 
     domain = lib.mkOption {
       type = lib.types.str;
       description = "Domain for the soju WebSocket endpoint (proxied by Caddy)";
     };
 
     port = lib.mkOption {
       type = lib.types.port;
       default = 6669;
       description = "Internal port for the soju WebSocket listener";
     };
 
     authLabel = haravara.authLabelOption;
 
     listen = lib.mkOption {
       type = lib.types.listOf lib.types.str;
       default = [":6697"];
       description = "Where soju should listen for incoming connections.";
     };
 
     hostName = lib.mkOption {
       type = lib.types.str;
       default = cfg.domain;
       defaultText = lib.literalExpression "config.services.haravara.soju.domain";
       description = "Server hostname.";
     };
 
     tlsCertificate = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       default = null;
       description = "Path to server TLS certificate.";
     };
 
     tlsCertificateKey = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       default = null;
       description = "Path to server TLS certificate key.";
     };
 
     acme = {
       enable = lib.mkEnableOption "Use Caddy-managed ACME certificates for soju";
       certificateDomain = lib.mkOption {
         type = lib.types.str;
         default = cfg.domain;
         description = "The domain name of the certificates in Caddy's storage.";
       };
       caddyCertDir = lib.mkOption {
         type = lib.types.str;
         default = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory";
         description = "Path to Caddy's ACME certificate directory";
       };
     };
 
     enableMessageLogging = lib.mkOption {
       type = lib.types.bool;
       default = true;
       description = "Whether to enable message logging.";
     };
 
     adminSocket.enable = lib.mkOption {
       type = lib.types.bool;
       default = true;
       description = "Listen for admin connections from sojuctl at /run/soju/admin.";
     };
 
     httpOrigins = lib.mkOption {
       type = lib.types.listOf lib.types.str;
       default = [];
       description = "List of allowed HTTP origins for WebSocket listeners.";
     };
 
     acceptProxyIP = lib.mkOption {
       type = lib.types.listOf lib.types.str;
       default = ["localhost"];
       description = "Allow the specified IPs to act as a proxy.";
     };
 
     extraConfig = lib.mkOption {
       type = lib.types.lines;
       default = "";
       description = "Lines added verbatim to the generated configuration file.";
     };
 
     stateDir = lib.mkOption {
       type = lib.types.str;
       default = "/var/lib/soju";
       description = "Directory for soju state data";
     };
 
     runtimeDir = lib.mkOption {
       type = lib.types.str;
       default = "/run/soju";
       description = "Runtime directory for soju";
     };
   };
 
   config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = (cfg.tlsCertificate != null) == (cfg.tlsCertificateKey != null);
         message = "services.haravara.soju.tlsCertificate and services.haravara.soju.tlsCertificateKey must both be specified to enable TLS.";
       }
     ];
 
     environment.systemPackages = [sojuctl];
 
     systemd.services.soju = {
       description = "soju IRC bouncer";
       wantedBy = ["multi-user.target"];
       wants = ["network-online.target" "caddy.service"];
       after = ["network-online.target" "caddy.service"];
       documentation = ["man:soju(1)"];
       serviceConfig = {
         DynamicUser = true;
         Restart = "always";
         ExecStart = "${cfg.package}/bin/soju -config ${configFile}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         StateDirectory = "soju";
         RuntimeDirectory = "soju";
         WorkingDirectory = cfg.stateDir;
 
         # Load certs from Caddy's storage
         LoadCredential = lib.optionals cfg.acme.enable [
           "cert.pem:${caddyCertDir}/${cfg.domain}.crt"
           "key.pem:${caddyCertDir}/${cfg.domain}.key"
         ];
 
         SupplementaryGroups = lib.optional cfg.acme.enable "caddy";
 
         # Hardening
         CapabilityBoundingSet = "";
         DeviceAllow = "";
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;
         PrivateTmp = true;
         ProtectClock = true;
         ProtectControlGroups = true;
         ProtectHome = true;
         ProtectHostname = true;
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
         ProtectSystem = "strict";
         RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"];
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = ["@system-service" "~@privileged"];
       };
     };
 
     services.caddy.virtualHosts."${cfg.domain}".extraConfig = lib.mkOrder 500 ''
       ${haravara.mkAuthImport cfg.authLabel}
       reverse_proxy 127.0.0.1:${toString cfg.port}
       redir / https://${haravara.stripSubdomain cfg.domain}
     '';
   };
 }