depot/third_party/nixpkgs/nixos/modules/services/web-apps/your_spotify.nix

{
  pkgs,
  config,
  lib,
  ...
}: let
  inherit
    (lib)
    boolToString
    concatMapAttrs
    concatStrings
    isBool
    mapAttrsToList
    mkEnableOption
    mkIf
    mkOption
    mkPackageOption
    optionalAttrs
    types
    mkDefault
    ;
  cfg = config.services.your_spotify;

  configEnv = concatMapAttrs (name: value:
    optionalAttrs (value != null) {
      ${name} =
        if isBool value
        then boolToString value
        else toString value;
    })
  cfg.settings;

  configFile = pkgs.writeText "your_spotify.env" (concatStrings (mapAttrsToList (name: value: "${name}=${value}\n") configEnv));
in {
  options.services.your_spotify = let
    inherit (types) nullOr port str path package;
  in {
    enable = mkEnableOption "your_spotify";

    enableLocalDB = mkEnableOption "a local mongodb instance";
    nginxVirtualHost = mkOption {
      type = nullOr str;
      default = null;
      description = ''
        If set creates an nginx virtual host for the client.
        In most cases this should be the CLIENT_ENDPOINT without
        protocol prefix.
      '';
    };

    package = mkPackageOption pkgs "your_spotify" {};

    clientPackage = mkOption {
      type = package;
      description = "Client package to use.";
    };

    spotifySecretFile = mkOption {
      type = path;
      description = ''
        A file containing the secret key of your Spotify application.
        Refer to: [Creating the Spotify Application](https://github.com/Yooooomi/your_spotify#creating-the-spotify-application).
      '';
    };

    settings = mkOption {
      description = ''
        Your Spotify Configuration. Refer to [Your Spotify](https://github.com/Yooooomi/your_spotify) for definitions and values.
      '';
      example = lib.literalExpression ''
        {
          CLIENT_ENDPOINT = "https://example.com";
          API_ENDPOINT = "https://api.example.com";
          SPOTIFY_PUBLIC = "spotify_client_id";
        }
      '';
      type = types.submodule {
        freeformType = types.attrsOf types.str;
        options = {
          CLIENT_ENDPOINT = mkOption {
            type = str;
            description = ''
              The endpoint of your web application.
              Has to include a protocol Prefix (e.g. `http://`)
            '';
            example = "https://your_spotify.example.org";
          };
          API_ENDPOINT = mkOption {
            type = str;
            description = ''
              The endpoint of your server
              This api has to be reachable from the device you use the website from not from the server.
              This means that for example you may need two nginx virtual hosts if you want to expose this on the
              internet.
              Has to include a protocol Prefix (e.g. `http://`)
            '';
            example = "https://localhost:3000";
          };
          SPOTIFY_PUBLIC = mkOption {
            type = str;
            description = ''
              The public client ID of your Spotify application.
              Refer to: [Creating the Spotify Application](https://github.com/Yooooomi/your_spotify#creating-the-spotify-application)
            '';
          };
          MONGO_ENDPOINT = mkOption {
            type = str;
            description = ''The endpoint of the Mongo database.'';
            default = "mongodb://localhost:27017/your_spotify";
          };
          PORT = mkOption {
            type = port;
            description = "The port of the api server";
            default = 3000;
          };
        };
      };
    };
  };

  config = mkIf cfg.enable {
    services.your_spotify.clientPackage = mkDefault (cfg.package.client.override {apiEndpoint = cfg.settings.API_ENDPOINT;});
    systemd.services.your_spotify = {
      after = ["network.target"];
      script = ''
        export SPOTIFY_SECRET=$(< "$CREDENTIALS_DIRECTORY/SPOTIFY_SECRET")
        ${lib.getExe' cfg.package "your_spotify_migrate"}
        exec ${lib.getExe cfg.package}
      '';
      serviceConfig = {
        User = "your_spotify";
        Group = "your_spotify";
        DynamicUser = true;
        EnvironmentFile = [configFile];
        StateDirectory = "your_spotify";
        LimitNOFILE = "1048576";
        PrivateTmp = true;
        PrivateDevices = true;
        StateDirectoryMode = "0700";
        Restart = "always";

        LoadCredential = ["SPOTIFY_SECRET:${cfg.spotifySecretFile}"];

        # Hardening
        CapabilityBoundingSet = "";
        LockPersonality = true;
        #MemoryDenyWriteExecute = true; # Leads to coredump because V8 does JIT
        PrivateUsers = true;
        ProtectClock = true;
        ProtectControlGroups = true;
        ProtectHome = true;
        ProtectHostname = true;
        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
        ProtectProc = "invisible";
        ProcSubset = "pid";
        ProtectSystem = "strict";
        RestrictAddressFamilies = [
          "AF_INET"
          "AF_INET6"
          "AF_NETLINK"
        ];
        RestrictNamespaces = true;
        RestrictRealtime = true;
        SystemCallArchitectures = "native";
        SystemCallFilter = [
          "@system-service"
          "@pkey"
        ];
        UMask = "0077";
      };
      wantedBy = ["multi-user.target"];
    };
    services.nginx = mkIf (cfg.nginxVirtualHost != null) {
      enable = true;
      virtualHosts.${cfg.nginxVirtualHost} = {
        root = cfg.clientPackage;
        locations."/".extraConfig = ''
          add_header Content-Security-Policy "frame-ancestors 'none';" ;
          add_header X-Content-Type-Options "nosniff" ;
          try_files = $uri $uri/ /index.html ;
        '';
      };
    };
    services.mongodb = mkIf cfg.enableLocalDB {
      enable = true;
    };
  };
  meta.maintainers = with lib.maintainers; [patrickdag];
}