char/topaz-flake

git clone https://git.t4t.associates/char/topaz-flake

Charlotte Sommove secrets to /var/lib/secrets39a1928

main
branchesmainall refs →
982 B37 linesraw
1{ lib, pkgs, ... }:
2let
3  city-role-bot = pkgs.callPackage ../packages/city-role-bot.nix { };
4in
5{
6  users.users.city-role-bot = {
7    isSystemUser = true;
8    group = "city-role-bot";
9  };
10  users.groups.city-role-bot = { };
11
12  systemd.services.city-role-bot = {
13    description = "city-role-bot";
14    after = [ "network-online.target" ];
15    wants = [ "network-online.target" ];
16    wantedBy = [ "multi-user.target" ];
17
18    environment.CITY_ROLE_BOT_DATA_DIR = "/var/lib/city-role-bot/data/";
19
20    serviceConfig = {
21      Type = "simple";
22      User = "city-role-bot";
23      Group = "city-role-bot";
24      StateDirectory = "city-role-bot";
25      WorkingDirectory = "/var/lib/city-role-bot";
26      EnvironmentFile = "/var/lib/secrets/city-role-bot.env";
27      ExecStart = lib.getExe city-role-bot;
28      Restart = "on-failure";
29      RestartSec = "5s";
30
31      NoNewPrivileges = true;
32      PrivateTmp = true;
33      ProtectSystem = "strict";
34      ProtectHome = true;
35    };
36  };
37}