lukegb/depot
1
0
Fork 0
Code Issues 1 Pull requests Projects Packages Activity Actions

nixos/lightspeed: init lightspeed-ingest and lightspeed-webrtc NixOS modules

Browse source
This commit is contained in:
Luke Granger-Brown 2021-01-04 15:50:42 +00:00
parent 1d564082d5
commit f91109cb50
2 changed files with 85 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
ops/nixos/lib/lightspeed/lightspeed-ingest.nix Normal file
View file

@ -0,0 +1,40 @@
{ depot, config, lib, ... }:
let
cfg = config.services.lightspeed.ingest;
inherit (lib) mkOption types mkEnableOption;
in
{
options.services.lightspeed.ingest = {
enable = mkEnableOption "Lightspeed Ingest server (FTL->RTP)";
};
config = lib.mkIf cfg.enable {
systemd.services.lightspeed-ingest = {
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${depot.pkgs.lightspeed-ingest}/bin/lightspeed-ingest";
DynamicUser = true;
ProtectSystem = "strict";
CapabilityBoundingSet = "";
RestrictAddressFamilies = "AF_INET AF_INET6";
RestrictNamespaces = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = "tmpfs";
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "noaccess";
SystemCallArchitectures = "native";
RestrictRealtime = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
UMask = "0077";
ProtectHostname = true;
};
};
};
}

45
ops/nixos/lib/lightspeed/lightspeed-webrtc.nix Normal file
View file

@ -0,0 +1,45 @@
{ depot, config, lib, ... }:
let
cfg = config.services.lightspeed.webrtc;
inherit (lib) mkOption types mkEnableOption;
in
{
options.services.lightspeed.webrtc = {
enable = mkEnableOption "Lightspeed WebRTC server (RTP->WebRTC)";
address = mkOption {
description = "Address to listen on for incoming RTP traffic and websockets";
default = "127.0.0.1";
type = types.str;
};
};
config = lib.mkIf cfg.enable {
systemd.services.lightspeed-webrtc = {
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${depot.pkgs.lightspeed-webrtc}/bin/lightspeed-webrtc -addr ${cfg.address}";
DynamicUser = true;
ProtectSystem = "strict";
CapabilityBoundingSet = "";
RestrictAddressFamilies = "AF_INET AF_INET6";
RestrictNamespaces = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = "tmpfs";
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "noaccess";
SystemCallArchitectures = "native";
RestrictRealtime = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
UMask = "0077";
ProtectHostname = true;
};
};
};
}