blob: 37d567e8b37149ba28df45dfbd44e13c3c23c163 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
{
config,
lib,
pkgs,
...
}:
let
inherit (lib) mkEnableOption mkIf mkMerge mkOption types;
cfg = config.services.bsky-news;
mkService = botName: bot: operation: {
description = "Bluesky ${botName} ${operation} job";
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
environment.BSKY_CREDENTIALS_FILE = "%d/bsky";
serviceConfig = {
Type = "oneshot";
ExecStart = lib.escapeShellArgs [
(lib.getExe' cfg.package "bsky-news")
botName
operation
];
LoadCredential = "bsky:${bot.credentialsFile}";
DynamicUser = true;
StateDirectory = "bsky-news-${botName}";
WorkingDirectory = "%S/bsky-news-${botName}";
UMask = "0077";
NoNewPrivileges = true;
PrivateTmp = true;
ProtectHome = true;
ProtectSystem = "strict";
ProtectClock = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictSUIDSGID = true;
};
};
mkTimer = unitName: schedule: randomizedDelaySec: {
description = "Run ${unitName} periodically";
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = schedule;
Persistent = true;
RandomizedDelaySec = randomizedDelaySec;
Unit = "${unitName}.service";
};
};
servicesForBot = botName: bot:
let
breakingUnit = "bsky-news-${botName}-breaking";
in
{
${breakingUnit} = mkService botName bot "breaking";
};
timersForBot = botName: bot:
let
breakingUnit = "bsky-news-${botName}-breaking";
in
{
${breakingUnit} = mkTimer breakingUnit bot.breakingNews.schedule bot.breakingNews.randomizedDelaySec;
};
in
{
options.services.bsky-news = {
enable = mkEnableOption "periodic Bluesky news bots";
package = mkOption {
type = types.package;
default = pkgs.callPackage ./default.nix { };
defaultText = lib.literalExpression "pkgs.callPackage ./default.nix { }";
description = "The bsky-news package to run.";
};
bots = mkOption {
default = { };
description = "Bluesky bot accounts and their schedules.";
type = types.attrsOf (types.submodule ({ ... }: {
options = {
credentialsFile = mkOption {
type = types.str;
description = ''
Path to a credentials file, normally an agenix secret. It is
exposed to the process through systemd's credential directory;
BSKY_CREDENTIALS_FILE contains the resulting path.
'';
};
breakingNews = {
schedule = mkOption {
type = types.str;
default = "*:0/10";
description = "systemd OnCalendar expression for breaking news.";
};
randomizedDelaySec = mkOption {
type = types.str;
default = "30s";
description = "Maximum random delay applied to breaking-news runs.";
};
};
};
}));
};
};
config = mkIf cfg.enable {
systemd.services = mkMerge (lib.mapAttrsToList servicesForBot cfg.bots);
systemd.timers = mkMerge (lib.mapAttrsToList timersForBot cfg.bots);
};
}
|
