infrastructure/modules/nixos/dgn-notify/default.nix

# SPDX-FileCopyrightText: 2024 Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{
  config,
  pkgs,
  lib,
  meta,
  nodeMeta,
  ...
}:

let
  inherit (lib)
    concatMapStringsSep
    getExe
    mkEnableOption
    mkForce
    mkIf
    ;

  emails = concatMapStringsSep ", " (name: meta.organization.members.${name}.email) nodeMeta.admins;

  cfg = config.dgn-notify;
in

{

  options.dgn-notify = {
    enable = mkEnableOption "DGNum email notification cli" // {
      default = true;
    };
  };

  config = mkIf cfg.enable {
    services.mail.sendmailSetuidWrapper.group = mkForce "mail";
    users.groups.mail = { };

    programs.msmtp = {
      enable = true;
      setSendmail = true;
      accounts.default = {
        tls = true;
        tls_starttls = false;
        port = 465;
        auth = true;
        host = "kurisu.lahfa.xyz";
        from = "noreply@infra.dgnum.eu";
        user = "web-services@infra.dgnum.eu";
        passwordeval = "cat ${config.age.secrets.mail.path}";
      };
    };

    services.systemd-notify = {
      enable = true;
      command = builtins.toString (
        pkgs.writeShellScript "sendmail" ''
          ${pkgs.msmtp}/bin/sendmail -i -t <<ERRMAIL
          To: admins+monitoring@dgnum.eu, ${emails}
          Subject: [$HOSTNAME] Systemd failure: $1
          Content-Transfer-Encoding: 8bit
          Content-Type: text/plain; charset=UTF-8

          $(systemctl status --full "$1")
          ERRMAIL

          ${getExe pkgs.jq} <(echo '{ topic: "monitoring", priority: 4 }') \
            '.title |= $title | .message |= $body' \
            --arg title "[$HOSTNAME] Systemd failure: $1" \
            --rawfile body <(systemctl status --full "$1") | \
            ${getExe pkgs.curl} https://push.dgnum.eu -d @- \
            -H "Authorization: Bearer $(cat ${config.age.secrets.ntfy.path})"
        ''
      );
    };
    age-secrets.sources = [ ./. ];
  };
}