nixos/omnom: init module

nixos/modules/module-list.nix

@@ -811,6 +811,7 @@
   ./services/misc/octoprint.nix
   ./services/misc/ollama.nix
   ./services/misc/ombi.nix
+  ./services/misc/omnom.nix
   ./services/misc/open-webui.nix
   ./services/misc/osrm.nix
   ./services/misc/owncast.nix

nixos/modules/services/misc/omnom.nix

@@ -0,0 +1,190 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.omnom;
+  settingsFormat = pkgs.formats.yaml { };
+
+  configFile = settingsFormat.generate "omnom-config.yml" cfg.settings;
+in
+{
+  options = {
+    services.omnom = {
+      enable = lib.mkEnableOption "Omnom, a webpage bookmarking and snapshotting service";
+      debug = lib.mkEnableOption "debug mode";
+      package = lib.mkPackageOption pkgs "omnom" { };
+
+      dataDir = lib.mkOption {
+        type = lib.types.str;
+        default = "/var/lib/omnom";
+        description = "The directory where Omnom stores its data files.";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 7331;
+        description = "The Omnom service port.";
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to open ports in the firewall.";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.nonEmptyStr;
+        default = "omnom";
+        description = "The Omnom service user.";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.nonEmptyStr;
+        default = "omnom";
+        description = "The Omnom service group.";
+      };
+
+      settings = lib.mkOption {
+        description = ''
+          Configuration options for the /etc/omnom/config.yml file.
+        '';
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            app = {
+              debug = lib.mkEnableOption "debug mode";
+              disable_signup = lib.mkEnableOption "restricting user creation";
+              results_per_page = lib.mkOption {
+                type = lib.types.int;
+                default = 20;
+                description = "Number of results per page.";
+              };
+            };
+            db = {
+              connection = lib.mkOption {
+                type = lib.types.str;
+                default = "${cfg.dataDir}/db.sqlite3";
+                description = "Database connection URI.";
+                defaultText = lib.literalExpression ''
+                  "''${config.services.omnom.dataDir}/db.sqlite3"
+                '';
+              };
+              type = lib.mkOption {
+                type = lib.types.enum [ "sqlite" ];
+                default = "sqlite";
+                description = "Database type.";
+              };
+            };
+            server = {
+              address = lib.mkOption {
+                type = lib.types.str;
+                default = "127.0.0.1:${toString cfg.port}";
+                description = "Server address.";
+                defaultText = lib.literalExpression ''
+                  "127.0.0.1:''${config.services.omnom.port}"
+                '';
+              };
+              secure_cookie = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+                description = "Limit cookies to secure channel.";
+              };
+            };
+            storage = {
+              root = lib.mkOption {
+                type = lib.types.path;
+                default = "${cfg.dataDir}/static/data";
+                defaultText = lib.literalExpression ''
+                  "''${config.services.omnom.dataDir}/static/data"
+                '';
+                description = "Where the snapshots are saved.";
+              };
+            };
+          };
+        };
+        default = { };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.etc."omnom/config.yml".source = configFile;
+
+    services.omnom.settings = {
+      app.debug = cfg.debug;
+      storage.type = lib.mkDefault "fs";
+    };
+
+    systemd.services.omnom = {
+      path = [ pkgs.rsync ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = "${lib.getExe cfg.package} listen --config ${configFile}";
+        StateDirectory = "omnom";
+        WorkingDirectory = cfg.dataDir;
+        Restart = "on-failure";
+        RestartSec = "10s";
+      };
+      after = [
+        "network.target"
+        "systemd-tmpfiles-resetup.service"
+        "systemd-tmpfiles-setup.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    # TODO: The program needs to run from the dataDir for it the work, which
+    # is difficult to do with a DynamicUser.
+    # After this has been fixed upstream, remove this and use DynamicUser, instead.
+    users = {
+      users = lib.mkIf (cfg.user == "omnom") {
+        omnom = {
+          group = cfg.group;
+          home = cfg.dataDir;
+          isSystemUser = true;
+        };
+      };
+      groups = lib.mkIf (cfg.group == "omnom") { omnom = { }; };
+    };
+
+    systemd.tmpfiles.settings."10-omnom" =
+      let
+        settings = {
+          inherit (cfg) user group;
+        };
+      in
+      {
+        "${cfg.dataDir}"."d" = settings;
+        "${cfg.dataDir}/templates"."L+" = settings // {
+          argument = "${cfg.package}/share/templates";
+        };
+        "${cfg.settings.storage.root}"."d" = settings;
+      }
+      // lib.optionalAttrs (cfg.settings.db.type == "sqlite") {
+        "${cfg.dataDir}/db.sqlite3"."f" = settings;
+      };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+
+    environment.systemPackages =
+      let
+        omnom-wrapped = pkgs.writeScriptBin "omnom" ''
+          #! ${pkgs.runtimeShell}
+          cd ${cfg.dataDir}
+          sudo=exec
+          if [[ "$USER" != ${cfg.user} ]]; then
+            sudo='exec /run/wrappers/bin/sudo -u ${cfg.user}'
+          fi
+          $sudo ${lib.getExe cfg.package} "$@"
+        '';
+      in
+      [ omnom-wrapped ];
+  };
+}