blob: 899d9dfc3c1089c9ff8d916996c9a6fdad0d577a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
{ config, lib, pkgs, ... }:
let
cfg = config.services.transfer-sh;
inherit (lib)
mkDefault mkEnableOption mkPackageOption mkIf mkOption
types mapAttrs isBool getExe boolToString mdDoc optionalAttrs;
in
{
options.services.transfer-sh = {
enable = mkEnableOption (mdDoc "Easy and fast file sharing from the command-line");
package = mkPackageOption pkgs "transfer-sh" { };
settings = mkOption {
type = types.submodule { freeformType = with types; attrsOf (oneOf [ bool int str ]); };
default = { };
example = {
LISTENER = ":8080";
BASEDIR = "/var/lib/transfer.sh";
TLS_LISTENER_ONLY = false;
};
description = mdDoc ''
Additional configuration for transfer-sh, see
<https://github.com/dutchcoders/transfer.sh#usage-1>
for supported values.
For secrets use secretFile option instead.
'';
};
provider = mkOption {
type = types.enum [ "local" "s3" "storj" "gdrive" ];
default = "local";
description = mdDoc "Storage providers to use";
};
secretFile = mkOption {
type = types.nullOr types.path;
default = null;
example = "/run/secrets/transfer-sh.env";
description = mdDoc ''
Path to file containing environment variables.
Useful for passing down secrets.
Some variables that can be considered secrets are:
- AWS_ACCESS_KEY
- AWS_ACCESS_KEY
- TLS_PRIVATE_KEY
- HTTP_AUTH_HTPASSWD
'';
};
};
config =
let
localProvider = (cfg.provider == "local");
stateDirectory = "/var/lib/transfer.sh";
in
mkIf cfg.enable
{
services.transfer-sh.settings = {
LISTENER = mkDefault ":8080";
} // optionalAttrs localProvider {
BASEDIR = mkDefault stateDirectory;
};
systemd.services.transfer-sh = {
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
environment = mapAttrs (_: v: if isBool v then boolToString v else toString v) cfg.settings;
serviceConfig = {
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
DevicePolicy = "closed";
DynamicUser = true;
ExecStart = "${getExe cfg.package} --provider ${cfg.provider}";
LockPersonality = true;
MemoryDenyWriteExecute = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
SystemCallArchitectures = [ "native" ];
SystemCallFilter = [ "@system-service" ];
StateDirectory = baseNameOf stateDirectory;
} // optionalAttrs (cfg.secretFile != null) {
EnvironmentFile = cfg.secretFile;
} // optionalAttrs localProvider {
ReadWritePaths = cfg.settings.BASEDIR;
};
};
};
meta.maintainers = with lib.maintainers; [ ocfox ];
}
|