Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243{ config, lib, options, pkgs, ...}:
with lib;
let cfg = config.services.coder; name = "coder";in{ options = { services.coder = { enable = mkEnableOption "Coder service";
user = mkOption { type = types.str; default = "coder"; description = '' User under which the coder service runs.
::: {.note} If left as the default value this user will automatically be created on system activation, otherwise it needs to be configured manually. ::: ''; };
group = mkOption { type = types.str; default = "coder"; description = '' Group under which the coder service runs.
::: {.note} If left as the default value this group will automatically be created on system activation, otherwise it needs to be configured manually. ::: ''; };
package = mkPackageOption pkgs "coder" { };
homeDir = mkOption { type = types.str; description = '' Home directory for coder user. ''; default = "/var/lib/coder"; };
listenAddress = mkOption { type = types.str; description = '' Listen address. ''; default = "127.0.0.1:3000"; };
accessUrl = mkOption { type = types.nullOr types.str; description = '' Access URL should be a external IP address or domain with DNS records pointing to Coder. ''; default = null; example = "https://coder.example.com"; };
wildcardAccessUrl = mkOption { type = types.nullOr types.str; description = '' If you are providing TLS certificates directly to the Coder server, you must use a single certificate for the root and wildcard domains. ''; default = null; example = "*.coder.example.com"; };
environment = { extra = mkOption { type = types.attrs; description = "Extra environment variables to pass run Coder's server with. See Coder documentation."; default = { }; example = { CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS = true; CODER_OAUTH2_GITHUB_ALLOWED_ORGS = "your-org"; }; }; file = mkOption { type = types.nullOr types.path; description = "Systemd environment file to add to Coder."; default = null; }; };
database = { createLocally = mkOption { type = types.bool; default = true; description = '' Create the database and database user locally. ''; };
host = mkOption { type = types.str; default = "/run/postgresql"; description = '' Hostname hosting the database. ''; };
database = mkOption { type = types.str; default = "coder"; description = '' Name of database. ''; };
username = mkOption { type = types.str; default = "coder"; description = '' Username for accessing the database. ''; };
password = mkOption { type = types.nullOr types.str; default = null; description = '' Password for accessing the database. ''; };
sslmode = mkOption { type = types.nullOr types.str; default = "disable"; description = '' Password for accessing the database. ''; }; };
tlsCert = mkOption { type = types.nullOr types.path; description = '' The path to the TLS certificate. ''; default = null; };
tlsKey = mkOption { type = types.nullOr types.path; description = '' The path to the TLS key. ''; default = null; }; }; };
config = mkIf cfg.enable { assertions = [ { assertion = cfg.database.createLocally -> cfg.database.username == name && cfg.database.database == cfg.database.username; message = "services.coder.database.username must be set to ${name} if services.coder.database.createLocally is set true"; } ];
systemd.services.coder = { description = "Coder - Self-hosted developer workspaces on your infra"; after = [ "network.target" ]; wantedBy = [ "multi-user.target" ];
environment = cfg.environment.extra // { CODER_ACCESS_URL = cfg.accessUrl; CODER_WILDCARD_ACCESS_URL = cfg.wildcardAccessUrl; CODER_PG_CONNECTION_URL = "user=${cfg.database.username} ${ optionalString (cfg.database.password != null) "password=${cfg.database.password}" } database=${cfg.database.database} host=${cfg.database.host} ${ optionalString (cfg.database.sslmode != null) "sslmode=${cfg.database.sslmode}" }"; CODER_ADDRESS = cfg.listenAddress; CODER_TLS_ENABLE = optionalString (cfg.tlsCert != null) "1"; CODER_TLS_CERT_FILE = cfg.tlsCert; CODER_TLS_KEY_FILE = cfg.tlsKey; };
serviceConfig = { ProtectSystem = "full"; PrivateTmp = "yes"; PrivateDevices = "yes"; SecureBits = "keep-caps"; AmbientCapabilities = "CAP_IPC_LOCK CAP_NET_BIND_SERVICE"; CacheDirectory = "coder"; CapabilityBoundingSet = "CAP_SYSLOG CAP_IPC_LOCK CAP_NET_BIND_SERVICE"; KillSignal = "SIGINT"; KillMode = "mixed"; NoNewPrivileges = "yes"; Restart = "on-failure"; ExecStart = "${cfg.package}/bin/coder server"; User = cfg.user; Group = cfg.group; EnvironmentFile = lib.mkIf (cfg.environment.file != null) cfg.environment.file; }; };
services.postgresql = lib.mkIf cfg.database.createLocally { enable = true; ensureDatabases = [ cfg.database.database ]; ensureUsers = [ { name = cfg.user; ensureDBOwnership = true; } ]; };
users.groups = optionalAttrs (cfg.group == name) { "${cfg.group}" = { }; }; users.users = optionalAttrs (cfg.user == name) { ${name} = { description = "Coder service user"; group = cfg.group; home = cfg.homeDir; createHome = true; isSystemUser = true; }; }; }; meta.maintainers = pkgs.coder.meta.maintainers;}