initial nixos module attempt

Author: Samasaur1

default.nix

@@ -6,6 +6,9 @@
 , zlib
 , stdenv
 , darwin
+, pandoc
+, texlive
+, makeWrapper
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,11 +27,20 @@ rustPlatform.buildRustPackage rec {
     libgit2
     openssl
     zlib
+    makeWrapper
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.IOKit
     darwin.apple_sdk.frameworks.Security
   ];
 
+  postFixup = ''
+    wrapProgram $out/bin/remote-text-server \
+      --set PATH ${lib.makeBinPath [
+        pandoc
+        texlive
+      ]}
+  '';
+
   env = {
     OPENSSL_NO_VENDOR = true;
     VERGEN_IDEMPOTENT = true;

flake.nix

@@ -13,7 +13,7 @@
         (system: gen nixpkgs.legacyPackages.${system});
     in {
       packages = forAllSystems (pkgs: rec {
-        remote-text-server = pkgs.callPackage ./. { };
+        remote-text-server = pkgs.callPackage ./. { texlive = pkgs.texliveFull; };
         default = remote-text-server;
         dockerImage = pkgs.dockerTools.buildImage {
           name = "remote-text-server";
@@ -23,5 +23,9 @@
           };
         };
       });
+      nixosModules = rec {
+        remote-text-server = import ./module.nix;
+        default = remote-text-server;
+      };
     };
 }

module.nix

@@ -0,0 +1,57 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.remote-text-server;
+in
+{
+  options.services.remote-text-server = {
+    enable = mkEnableOption "remote-text-server";
+    package = mkOption {
+      default = pkgs.callPackage ./. { texlive = pkgs.texliveFull; };
+      defaultText = "remote-text-server";
+      description = "The remote-text-server package to use";
+      type = types.package;
+    };
+    port = mkOption {
+      type = types.port;
+      default = 7870;
+      example = 46264;
+      description = "The port to listen on. Currently ignored and always uses 3030";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.remote-text-server = {
+      description = "RemoteText Server";
+
+      script = ''
+        cd $STATE_DIRECTORY
+        ${cfg.package}/bin/remote-text-server --port ${toString cfg.port}
+      '';
+
+      serviceConfig = {
+        DynamicUser = true;
+        # EnvironmentFile = "/etc/jekyll-comments-env";
+        StateDirectory = "remote-text-server";
+
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+      };
+
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+    };
+    # unnecessary bc tailscale is open. also should be set by the end user
+    # networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ cfg.port ];
+  };
+}