infrastructure/modules/nixos/ntfy-sh/default.nix

# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{
  config,
  lib,
  pkgs,
  ...
}:

let
  inherit (lib)
    getExe'
    mapAttrsToList
    mkEnableOption
    mkIf
    mkOption
    xor
    ;
  inherit (lib.types)
    attrsOf
    enum
    listOf
    nullOr
    path
    str
    submodule
    ;

  cfg = config.services.ntfy-sh.accessControl;

  inherit (config.services.ntfy-sh) settings;

  acl_file = (pkgs.formats.json { }).generate "acl.json" { inherit (cfg) access users; };

  ntfy-acl = pkgs.substituteAll {
    inherit (pkgs) python3;
    inherit acl_file;

    user_db = settings.auth-file;
    ntfy = getExe' config.services.ntfy-sh.package "ntfy";

    name = "ntfy-acl";
    src = ./ntfy-acl.py;
    dir = "bin";
    isExecutable = true;
  };
in

{
  options.services.ntfy-sh.accessControl = {
    enable = mkEnableOption "declarative management of users and acl for ntfy.sh";

    users = mkOption {
      type = attrsOf (submodule {
        options = {
          role = mkOption {
            type = enum [
              "admin"
              "user"
            ];
            description = "Role of the user.";
            default = "user";
          };
          passwordFile = mkOption {
            type = nullOr path;
            description = ''
              Path to a file containing the password of the user.

              Conflicts with `hashedPassword`.
            '';
            default = null;
          };
          hashedPassword = mkOption {
            type = nullOr str;
            description = ''
              Hashed password of the user.

              Conflicts with `passwordFile`.
            '';
            default = null;
          };
        };
      });
      description = ''
        Attribute set defining users of the ntfy.sh instance.
      '';
      default = { };
    };

    access = mkOption {
      type = listOf (submodule {
        options = {
          username = mkOption {
            type = str;
            description = ''
              A USERNAME is an existing user, as created with ntfy user add (see users and roles),
              or the anonymous user everyone or *, which represents clients that access the API
              without username/password.
            '';
            default = "*";
          };
          topic = mkOption {
            type = str;
            description = ''
              A TOPIC is either a specific topic name (e.g. mytopic, or phil_alerts),
              or a wildcard pattern that matches any number of topics (e.g. alerts_* or ben-*).
              Only the wildcard character * is supported.
              It stands for zero to any number of characters.
            '';
          };
          permission = mkOption {
            type = enum [
              "rw"
              "ro"
              "wo"
              "none"
            ];
            description = ''
              Permission for this access.
              - rw: Allows publishing messages to the given topic, as well as subscribing and reading messages
              - ro: Allows only subscribing and reading messages, but not publishing to the topic
              - wo: Allows only publishing to the topic, but not subscribing to it
              - none: Allows neither publishing nor subscribing to a topic
            '';
          };
        };
      });
      description = "List of access control rules.";
      default = [ ];
    };
  };

  config = mkIf cfg.enable {
    assertions = mapAttrsToList (name: user: {
      assertion = xor (user.hashedPassword != null) (user.passwordFile != null);
      message = ''
        Exactly one of `services.ntfy-sh.accessControl.users.<name>.hashedPassword`
        and `services.ntfy-sh.accessControl.users.<name>.passwordFile`
        is required for `name` = `${name}`.
      '';
    }) cfg.users;

    services.ntfy-sh.settings = {
      enable-signup = false;
    };

    systemd.tmpfiles.rules = [
      "f /var/lib/ntfy-sh/.acl-path 0600 ${config.services.ntfy-sh.user} ${config.services.ntfy-sh.group} - -"
    ];
    systemd.services.ntfy-sh.preStart = "${ntfy-acl}/bin/ntfy-acl";
  };
}