vineyard

self: { config, lib, pkgs, ... }:

let

  cfg = config.services.vineyard;

  toml = pkgs.formats.toml { };

  peerToml = peer: {

    url = peer.url;

    query_limit = peer.queryLimit;

  } // lib.optionalAttrs (peer.rescanFrom != null) {

    rescan_from = peer.rescanFrom;

  };

  configFile = toml.generate "vineyard.toml" {

    listen = cfg.listen;

    public_url = cfg.publicUrl;

    database = "/var/lib/vineyard/events.sqlite";

    forge_pubkeys = cfg.forgePubkeys;

    peers = map peerToml cfg.peers;

    allow_private_discovery = cfg.allowPrivateDiscovery;

    limits = cfg.limits;

  };

  port = lib.strings.toIntBase10 (lib.last (lib.splitString ":" cfg.listen));

in

{

  options.services.vineyard = {

    enable = lib.mkEnableOption "vineyard";

    package = lib.mkOption {

      type = lib.types.package;

      default = self.packages.${pkgs.stdenv.hostPlatform.system}.default;

      description = "vineyard package to run";

    };

    listen = lib.mkOption {

      type = lib.types.str;

      default = "127.0.0.1:7777";

      description = "address and port for vineyard to listen on";

    };

    publicUrl = lib.mkOption {

      type = lib.types.str;

      default = "";

      description = "public websocket url for vineyard";

    };

    forgePubkeys = lib.mkOption {

      type = lib.types.listOf lib.types.str;

      default = [ ];

      description = "locally hosted forge public keys in hex";

    };

    peers = lib.mkOption {

      type = lib.types.listOf (lib.types.submodule {

        options = {

          url = lib.mkOption {

            type = lib.types.str;

            description = "peer relay url";

          };

          queryLimit = lib.mkOption {

            type = lib.types.ints.positive;

            default = 500;

            description = "peer query limit";

          };

          rescanFrom = lib.mkOption {

            type = lib.types.nullOr lib.types.ints.unsigned;

            default = null;

            description = "peer rescan timestamp";

          };

        };

      });

      default = [ ];

      description = "peer relays for event exchange";

    };

    allowPrivateDiscovery = lib.mkOption {

      type = lib.types.bool;

      default = false;

      description = "allow discovered relays on private networks";

    };

    limits = lib.mkOption {

      type = lib.types.attrsOf lib.types.int;

      default = { };

      description = "relay limit overrides";

    };

    openFirewall = lib.mkOption {

      type = lib.types.bool;

      default = false;

      description = "open firewall for listen port";

    };

  };

  config = lib.mkIf cfg.enable {

    assertions = [

      {

        assertion = cfg.publicUrl != "";

        message = "publicUrl must be set";

      }

      {

        assertion = cfg.forgePubkeys != [ ];

        message = "forgePubkeys must not be empty";

      }

    ];

    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ port ];

    systemd.services.vineyard = {

      description = "vineyard nostr relay";

      wantedBy = [ "multi-user.target" ];

      after = [ "network-online.target" ];

      wants = [ "network-online.target" ];

      serviceConfig = {

        ExecStartPre = "${cfg.package}/bin/vineyard check-config --config ${configFile}";

        ExecStart = "${cfg.package}/bin/vineyard serve --config ${configFile}";

        DynamicUser = true;

        StateDirectory = "vineyard";

        StateDirectoryMode = "0700";

        WorkingDirectory = "/var/lib/vineyard";

        UMask = "0077";

        Restart = "on-failure";

        RestartSec = "5";

        NoNewPrivileges = true;

        ProtectSystem = "strict";

        ProtectHome = true;

        PrivateTmp = true;

        PrivateDevices = true;

        ProtectKernelTunables = true;

        ProtectKernelModules = true;

        ProtectControlGroups = true;

        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" ];

        RestrictNamespaces = true;

        LockPersonality = true;

        RestrictRealtime = true;

        RestrictSUIDSGID = true;

        RemoveIPC = true;

        CapabilityBoundingSet = "";

      };

    };

  };

}