jelq

self:

{

  config,

  lib,

  pkgs,

  ...

}:

let

  cfg = config.services.jelqd;

  host = if lib.hasInfix ":" cfg.address then "[${cfg.address}]" else cfg.address;

in

{

  options.services.jelqd = {

    enable = lib.mkEnableOption "jelqd, a roguelike played entirely over HTTP";

    package = lib.mkOption {

      type = lib.types.package;

      default = self.packages.${pkgs.stdenv.hostPlatform.system}.default;

      defaultText = lib.literalExpression "jelq.packages.\${pkgs.stdenv.hostPlatform.system}.default";

      description = "The jelqd package to run.";

    };

    address = lib.mkOption {

      type = lib.types.str;

      default = "127.0.0.1";

      description = "Address to listen on.";

    };

    port = lib.mkOption {

      type = lib.types.port;

      default = 6969;

      description = "Port to listen on.";

    };

    openFirewall = lib.mkOption {

      type = lib.types.bool;

      default = false;

      description = "Open the listening port in the firewall.";

    };

    dataDir = lib.mkOption {

      type = lib.types.path;

      default = "/var/lib/jelqd";

      description = "Directory holding the sqlite database of finished runs.";

    };

    oracle = lib.mkOption {

      type = lib.types.enum [

        "rng"

        "clm"

      ];

      default = "rng";

      description = "Where the oracle gets its answers.";

    };

    clmUrl = lib.mkOption {

      type = lib.types.str;

      default = "http://127.0.0.1:8700/v1/systemone";

      description = "CLM endpoint used when `oracle` is `clm`.";

    };

    environmentFile = lib.mkOption {

      type = lib.types.nullOr lib.types.path;

      default = null;

      example = "/run/secrets/jelqd.env";

      description = ''

        Environment file passed to the service, for setting `JELQD_SECRET`.

        Without it the run-signing secret is regenerated on every restart

        and live runs stop being accepted.

      '';

    };

  };

  config = lib.mkIf cfg.enable {

    users.users.jelqd = {

      isSystemUser = true;

      group = "jelqd";

      home = cfg.dataDir;

    };

    users.groups.jelqd = { };

    systemd.tmpfiles.settings.jelqd = lib.mkIf (cfg.dataDir != "/var/lib/jelqd") {

      ${cfg.dataDir}.d = {

        user = "jelqd";

        group = "jelqd";

        mode = "0750";

      };

    };

    systemd.services.jelqd = {

      description = "jelqd roguelike server";

      wantedBy = [ "multi-user.target" ];

      after = [ "network.target" ];

      environment = {

        JELQD_ADDR = "${host}:${toString cfg.port}";

        JELQD_DB = "${cfg.dataDir}/jelqd.sqlite";

        JELQD_ORACLE = cfg.oracle;

      }

      // lib.optionalAttrs (cfg.oracle == "clm") { JELQD_CLM_URL = cfg.clmUrl; };

      serviceConfig = {

        ExecStart = lib.getExe cfg.package;

        User = "jelqd";

        Group = "jelqd";

        Restart = "on-failure";

        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;

        StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/jelqd") "jelqd";

        StateDirectoryMode = "0750";

        ReadWritePaths = [ cfg.dataDir ];

        CapabilityBoundingSet = "";

        LockPersonality = true;

        MemoryDenyWriteExecute = true;

        NoNewPrivileges = true;

        PrivateDevices = true;

        PrivateTmp = true;

        ProtectClock = true;

        ProtectControlGroups = true;

        ProtectHome = true;

        ProtectHostname = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "invisible";

        ProtectSystem = "strict";

        RestrictAddressFamilies = [

          "AF_INET"

          "AF_INET6"

        ];

        RestrictNamespaces = true;

        RestrictRealtime = true;

        RestrictSUIDSGID = true;

        SystemCallArchitectures = "native";

        SystemCallFilter = [

          "@system-service"

          "~@privileged"

        ];

        UMask = "0077";

      };

    };

    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];

  };

}