set up spacebar-server

services/spacebar.nix

@@ -0,0 +1,139 @@
+{
+  ssh-pub-keys,
+  spacebar-server,
+  pkgs,
+  lib,
+  ...
+}: let
+  botPolicies-nix = {
+    dnsbl = false;
+    status_codes = {
+      CHALLENGE = 200;
+      DENY = 200;
+    };
+    bots = [
+      {
+        name = "catch-everything";
+        user_agent_regex = ".*";
+        action = "CHALLENGE";
+      }
+    ];
+  };
+in {
+  services.anubis = {
+    instances.spacebar = {
+      enable = true;
+      settings = {
+        BIND = "[::1]:9780";
+        BIND_NETWORK = "tcp";
+        DIFFICULTY = 4;
+        METRICS_BIND = "[::1]:9781";
+        METRICS_BIND_NETWORK = "tcp";
+        POLICY_FNAME = "/etc/anubis/spacebar.botPolicies.yaml";
+        TARGET = "http://localhost:8282";
+      };
+    };
+  };
+  environment.etc."anubis/spacebar.botPolicies.yaml" = {
+    source = (pkgs.formats.yaml {}).generate "" botPolicies-nix;
+    mode = "644";
+  };
+  systemd.services.spacebar-server = {
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${lib.getExe spacebar-server.packages.x86_64-linux.default}";
+      RemainAfterExit = true;
+      User = "spacebar";
+      Group = "spacebar";
+    };
+    environment = {
+      DATABASE = "/var/lib/spacebar-server/database.db";
+      STORAGE_LOCATION = "/var/lib/spacebar-server/files/";
+    };
+  };
+  users.users.spacebar = {
+    isSystemUser = true;
+    group = "spacebar";
+    description = "spacebar";
+    home = "/var/lib/spacebar-server";
+    createHome = true;
+    packages = [pkgs.git spacebar-server.packages.x86_64-linux.default];
+    shell = pkgs.bash;
+    openssh.authorizedKeys.keys = ssh-pub-keys;
+  };
+  users.groups.spacebar = {};
+
+  # Enable container name DNS for non-default Docker networks.
+  # https://github.com/NixOS/nixpkgs/issues/226365
+  networking.firewall.interfaces."docker+".allowedUDPPorts = [53];
+
+  virtualisation.oci-containers.backend = "docker";
+
+  # Containers
+  virtualisation.oci-containers.containers."spaceclient-jank" = {
+    image = "docker.io/compose2nix/spaceclient-jank";
+    ports = [
+      "8282:8080/tcp"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=jank"
+      "--network=spaceclient_default"
+    ];
+  };
+  systemd.services."docker-spaceclient-jank" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "docker-network-spaceclient_default.service"
+    ];
+    requires = [
+      "docker-network-spaceclient_default.service"
+    ];
+    partOf = [
+      "docker-compose-spaceclient-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-spaceclient-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."docker-network-spaceclient_default" = {
+    path = [pkgs.docker];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "docker network rm -f spaceclient_default";
+    };
+    script = ''
+      docker network inspect spaceclient_default || docker network create spaceclient_default
+    '';
+    partOf = ["docker-compose-spaceclient-root.target"];
+    wantedBy = ["docker-compose-spaceclient-root.target"];
+  };
+
+  # Builds
+  systemd.services."docker-build-spaceclient-jank" = {
+    path = [pkgs.docker pkgs.git];
+    serviceConfig = {
+      Type = "oneshot";
+      TimeoutSec = 300;
+    };
+    script = ''
+      cd /home/mtgmonkey/spaceclient
+      docker build -t compose2nix/spaceclient-jank .
+    '';
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."docker-compose-spaceclient-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = ["multi-user.target"];
+  };
+}