1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108

{
  pkgs,
  lib,
  config,
  ...
}:
let
  cfg = config.services.tailproxy;
  pkg = pkgs.callPackage ./tailproxy.nix { inherit pkgs; };
  toArgs =
    settings:
    let
      fmt = v: if lib.isBool v then lib.boolToString v else toString v;
    in
    lib.escapeShellArgs (
      lib.concatLists (
        lib.mapAttrsToList (k: v: map (x: "--${k}=${fmt x}") (lib.toList v)) (
          lib.filterAttrs (_: v: v != null) settings
        )
      )
    );
  instanceOptions =
    { name, ... }:
    let
      inherit (lib)
        mkEnableOption
        mkOption
        mkDefault
        types
        ;
    in
    {
      options = {
        enable = mkEnableOption "Enable tailproxy for ${name}";

        package = mkOption {
          type = types.package;
          description = "tailproxy package to use";
          default = pkg;
        };

        settings = lib.mkOption {
          type = lib.types.submodule {
            options = import ./options.gen.nix { inherit lib; };
          };
          default = { };
          description = "${name} settings, passed to tailproxy as command-line flags.";
        };

        dataDir = mkOption {
          type = types.str;
          description = "tsnet data directory (takes precedence over the settings data-dir)";
          default = "/var/lib/tailproxy-${name}";
        };

        user = mkOption {
          type = types.str;
          default = "tailproxy-${name}";
          description = "User account under which tailproxy runs";
        };

        group = mkOption {
          type = types.str;
          default = "tailproxy-${name}";
          description = "Group account under which tailproxy runs";
        };
      };
      config.settings.data-dir = mkDefault "/var/lib/tailproxy-${name}";
    };
in
{
  options = {
    services.tailproxy = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule instanceOptions);
      default = { };
      description = "Attribute set of tailproxy instances";
    };
  };
  config = lib.mkIf (cfg != { }) {
    systemd.services = lib.mapAttrs' (
      name: instanceCfg:
      lib.nameValuePair "tailproxy-${name}" {
        description = "tailproxy-${name}";
        wantedBy = [ "multi-user.target" ];
        after = [ "network.target" ];
        serviceConfig = {
          ExecStart = "${instanceCfg.package}/bin/tailproxy ${toArgs instanceCfg.settings}";
          User = instanceCfg.user;
          Restart = "on-failure";
        };
      }
    ) (lib.filterAttrs (name: instanceCfg: instanceCfg.enable) cfg);

    users.users = lib.mapAttrs' (
      name: instanceCfg:
      lib.nameValuePair instanceCfg.user {
        isSystemUser = true;
        group = instanceCfg.user;
        home = instanceCfg.settings.data-dir;
        createHome = true;
      }
    ) (lib.filterAttrs (name: instanceCfg: instanceCfg.enable) cfg);

    users.groups = lib.mapAttrs' (name: instanceCfg: lib.nameValuePair instanceCfg.user { }) (
      lib.filterAttrs (name: instanceCfg: instanceCfg.enable) cfg
    );
  };
}