Something went wrong. Try again.
Just the source code for my personal website. forked from crashkeys.dev/audsite
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192{ description = "Personal website flake."; inputs = { nixpkgs.url = "nixpkgs/nixos-unstable"; naersk.url = "github:nix-community/naersk"; naersk.inputs.nixpkgs.follows = "nixpkgs"; }; outputs = { self, nixpkgs, naersk, }: let supportedSystems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ]; forAllSystems = nixpkgs.lib.genAttrs supportedSystems; cargoConfig = builtins.fromTOML (builtins.readFile ./Cargo.toml); pkgName = cargoConfig.package.name; in { packages = forAllSystems ( system: let pkgs = (import nixpkgs) { inherit system; }; naersk' = pkgs.callPackage naersk { }; app = naersk'.buildPackage { src = ./.; postInstall = '' cp -r ./templates ./static $out ''; }; in { default = app; docker = pkgs.dockerTools.streamLayeredImage { name = "localhost/${pkgName}"; tag = "latest"; contents = [ app pkgs.bash ]; config.Cmd = [ "${app}/bin/${pkgName}" ]; }; } );
nixosModules.default = { config, pkgs, lib, ... }: let cfg = config.crashkeys.services.${pkgName}; in { options = { crashkeys.services.${pkgName} = { enable = lib.mkEnableOption "Enables the crashkeys.dev web server."; package = lib.mkOption { type = lib.types.package; default = self.packages.${pkgs.system}.default; description = "The Nix package corresponding to the web server to run."; }; public_url = lib.mkOption { type = lib.types.str; example = "https://crashkeys.dev"; description = '' The base public URL the site will be available at. Note that this value is only used to generate OpenGraph tags. ''; }; address = lib.mkOption { type = lib.types.str; default = "127.0.0.1"; example = "127.0.0.1"; description = "The IP address which the web server will bind to."; }; port = lib.mkOption { type = lib.types.port; default = 8000; example = 8000; description = "The TCP port on which the web server will be exposed."; }; }; }; config = let # The generated systemd service unit's name serviceName = "crashkeys.${pkgName}"; in lib.mkIf cfg.enable { systemd.services."${serviceName}" = { wantedBy = [ "multi-user.target" ]; serviceConfig = let pkg = cfg.package; in { Restart = "on-failure"; ExecStart = "${pkg}/bin/${pkgName}"; DynamicUser = "yes";
# The package includes the web server's static assets, # so we must run it at its output directory in the Nix store WorkingDirectory = "${pkg}"; RuntimeDirectory = "${serviceName}"; RuntimeDirectoryMode = "0755"; StateDirectory = "${serviceName}"; StateDirectoryMode = "0700"; CacheDirectory = "${serviceName}"; CacheDirectoryMode = "0750"; BindReadOnlyPaths = [ "${pkg}" ]; Environment = [ "ROCKET_ADDRESS=${cfg.address}" "ROCKET_PORT=${builtins.toString cfg.port}" "ROCKET_PUBLIC_URL=${cfg.public_url}" ];
NoNewPrivileges = true; PrivateDevices = true; ProtectClock = true; CapabilityBoundingSet = ""; # Clear all capabilities RestrictSUIDSGID = true; ProtectKernelLogs = true; ProtectControlGroups = true; ProtectKernelModules = true; PrivateMounts = true; RestrictNamespaces = true; ProtectHostname = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; ProtectSystem = "full"; ProtectProc = "noaccess"; ProcSubset = "pid"; PrivateUsers = true; PrivateTmp = true; ProtectKernelTunables = true; LockPersonality = true; RestrictRealtime = true; MemoryDenyWriteExecute = true; }; }; }; };
# For `nix develop` (optional, can be skipped): devShells = forAllSystems ( system: let pkgs = (import nixpkgs) { inherit system; }; in { default = pkgs.mkShell { nativeBuildInputs = with pkgs; [ rustc cargo jujutsu just ]; }; } );
formatter = forAllSystems ( system: let pkgs = (import nixpkgs) { inherit system; }; in pkgs.nixfmt-tree ); };}