straylight: add tracker web service

2026-09-18 21:20:17 -07:00
parent fdf50e0606
commit 77212bbdb7
4 changed files with 76 additions and 0 deletions
@@ -0,0 +1,72 @@
+# tracker: single-host project tracker web app (hackerman edition).
+# Wraps the prebuilt Go binary in ./tracker-bin; rebuild it with
+#   CGO_ENABLED=0 go build -o tracker-bin .
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.tracker;
+
+  trackerPackage = pkgs.stdenvNoCC.mkDerivation {
+    pname = "tracker";
+    version = "0.1.0";
+    src = ./tracker-bin;
+    dontUnpack = true;
+    dontBuild = true;
+    installPhase = ''
+      install -Dm755 $src $out/bin/tracker
+    '';
+  };
+in
+{
+  options.services.tracker = {
+    enable = mkEnableOption "tracker project tracker web app";
+
+    address = mkOption {
+      type = types.str;
+      default = ":8420";
+      description = "Address for the tracker web server to listen on.";
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Open the firewall for the tracker port on the tailscale interface.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users.tracker = {
+      isSystemUser = true;
+      group = "tracker";
+      description = "tracker service user";
+    };
+    users.groups.tracker = { };
+
+    systemd.services.tracker = {
+      description = "tracker project tracker (hackerman edition)";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        User = "tracker";
+        Group = "tracker";
+        StateDirectory = "tracker";
+        ExecStart = "${trackerPackage}/bin/tracker -addr ${cfg.address} -db /var/lib/tracker/tracker.db";
+        Restart = "on-failure";
+        RestartSec = 5;
+
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+      };
+    };
+
+    networking.firewall.interfaces."tailscale0".allowedTCPPorts =
+      mkIf cfg.openFirewall [ (toInt (removePrefix ":" cfg.address)) ];
+  };
+}