infrastructure/modules/nixos/nimbolus-tf.nix

# SPDX-FileCopyrightText: 2025 Lubin Bailly <lubin@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{
  lib,
  config,
  pkgs,
  ...
}:
let
  inherit (lib)
    escapeShellArg
    getExe
    mkEnableOption
    mkIf
    mkOption
    ;
  inherit (lib.types)
    attrsOf
    package
    path
    str
    ;

  # from nixpkgs, commit b1371135b5db3fcf728114d92d5bd0218109598a
  # FIXME: Should be replaced by nixpkgs lib when going to nixos-25.05
  concatMapAttrsStringSep =
    sep: f: attrs:
    lib.concatStringsSep sep (lib.attrValues (lib.mapAttrs f attrs));

  cfg = config.services.nimbolus-tf;
in
{
  options.services.nimbolus-tf = {
    enable = mkEnableOption "the nimbolus terraform http backend";
    package = mkOption {
      type = package;
      description = ''
        The hello package to use.
      '';
      example = "kat-pkgs.nimbolus-tf-backend";
    };
    environment = mkOption {
      type = attrsOf str;
      default = { };
      description = ''
        Environment variables for nimbolus configuration.
      '';
    };
    secretEnvironment = mkOption {
      type = attrsOf path;
      default = { };
      description = ''
        Files for secret environment variables for nimbolus configuration.
      '';
    };
  };
  config = mkIf cfg.enable {
    systemd.services."nimbolus-tf" = {
      description = "Nimbolus terraform http backend";
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        EnvironmentFile = "-/run/nimbolus-tf/env-file";
        ExecStart = "${getExe cfg.package}";
        ExecStartPre = "+${pkgs.writeShellScript "nimbolus-prestart" ''
          echo -n > /run/nimbolus-tf/env-file
          ${concatMapAttrsStringSep "\n" (
            key: value: "echo ${escapeShellArg "${key}=${value}"} >> /run/nimbolus-tf/env-file"
          ) cfg.environment}
          ${concatMapAttrsStringSep "\n" (
            key: value: ''echo "${key}=$(cat ${value})" >> /run/nimbolus-tf/env-file''
          ) cfg.secretEnvironment}
          chmod a+r /run/nimbolus-tf/env-file
        ''}";

        RuntimeDirectory = "nimbolus-tf";
        RuntimeDirectoryMode = "0700";
        StateDirectory = "nimbolus-tf";
        StateDirectoryMode = "0700";
        WorkingDirectory = "/var/lib/nimbolus-tf";

        # Hardening
        DynamicUser = true;
        CapabilityBoundingSet = "";
        PrivateDevices = true;
        ProtectClock = true;
        ProtectKernelLogs = true;
        ProtectControlGroups = true;
        ProtectKernelModules = true;
        RestrictNamespaces = true;
        ProtectHostname = true;
        LockPersonality = true;
        RestrictRealtime = true;
        ProtectHome = true;
        ProtectProc = "noaccess";
        ProcSubset = "pid";
        PrivateUsers = true;
        UMask = "0077";
        ProtectKernelTunables = true;
        RestrictAddressFamilies = "AF_INET AF_INET6";
        SystemCallFilter = "~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @resources @swap";
        MemoryDenyWriteExecute = true;
        SystemCallArchitectures = "native";
      };
    };
  };
}