1{
  2  inputs = {
  3    naersk.url = "github:nix-community/naersk/master";
  4    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
  5    utils.url = "github:numtide/flake-utils";
  6  };
  7
  8  outputs = { self, nixpkgs, utils, naersk }:
  9    utils.lib.eachDefaultSystem (system:
 10      let
 11        pkgs = import nixpkgs { inherit system; };
 12        naersk-lib = pkgs.callPackage naersk { };
 13      in
 14      {
 15        defaultPackage = naersk-lib.buildPackage {
 16          root = ./.;
 17          nativeBuildInputs = with pkgs; [ pkg-config clang ];
 18          buildInputs = with pkgs; [ openssl ];
 19          LIBCLANG_PATH = "${pkgs.clang.cc.lib}/lib";
 20          ROCKSDB_LIB_DIR = "${pkgs.rocksdb}/lib";
 21        };
 22        devShell = with pkgs; mkShell {
 23          buildInputs = [ cargo rustc rustfmt pre-commit rustPackages.clippy ];
 24          RUST_SRC_PATH = rustPlatform.rustLibSrc;
 25        };
 26
 27        nixosModules.default = { config, lib, pkgs, ... }:
 28        with lib;
 29        let
 30          cfg = config.services.rgit;
 31        in
 32        {
 33          options.services.rgit = {
 34            enable = mkEnableOption "rgit";
 35            bindAddress = mkOption {
 36              default = "[::]:8333";
 37              description = "Address and port to listen on";
 38              type = types.str;
 39            };
 40            dbStorePath = mkOption {
 41              default = "/tmp/rgit.db";
 42              description = "Path to store the temporary cache";
 43              type = types.path;
 44            };
 45            repositoryStorePath = mkOption {
 46              default = "/git";
 47              description = "Path to repositories";
 48              type = types.path;
 49            };
 50          };
 51
 52          config = mkIf cfg.enable {
 53            users.groups.rgit = { };
 54            users.users.rgit = {
 55              description = "RGit service user";
 56              group = "rgit";
 57              isSystemUser = true;
 58              home = "/git";
 59            };
 60
 61            systemd.services.rgit = {
 62              enable = true;
 63              wantedBy = [ "multi-user.target" ];
 64              after = [ "network-online.target" ];
 65              path = [ pkgs.git ];
 66              serviceConfig = {
 67                Type = "exec";
 68                ExecStart = "${self.defaultPackage."${system}"}/bin/rgit --db-store ${cfg.dbStorePath} ${cfg.bindAddress} ${cfg.repositoryStorePath}";
 69                Restart = "on-failure";
 70
 71                User = "rgit";
 72                Group = "rgit";
 73
 74                CapabilityBoundingSet = "";
 75                NoNewPrivileges = true;
 76                PrivateDevices = true;
 77                PrivateTmp = true;
 78                PrivateUsers = true;
 79                PrivateMounts = true;
 80                ProtectHome = true;
 81                ProtectClock = true;
 82                ProtectProc = "noaccess";
 83                ProcSubset = "pid";
 84                ProtectKernelLogs = true;
 85                ProtectKernelModules = true;
 86                ProtectKernelTunables = true;
 87                ProtectControlGroups = true;
 88                ProtectHostname = true;
 89                RestrictSUIDSGID = true;
 90                RestrictRealtime = true;
 91                RestrictNamespaces = true;
 92                LockPersonality = true;
 93                RemoveIPC = true;
 94                RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
 95                SystemCallFilter = [ "@system-service" "~@privileged" ];
 96              };
 97            };
 98          };
 99        };
100      });
101}