depot/third_party/nixpkgs/nixos/modules/services/networking/xandikos.nix
Default email 504525a148 Project import generated by Copybara.
GitOrigin-RevId: bd645e8668ec6612439a9ee7e71f7eac4099d4f6
2024-01-02 12:29:13 +01:00

143 lines
3.8 KiB
Nix

{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.xandikos;
in
{
options = {
services.xandikos = {
enable = mkEnableOption (lib.mdDoc "Xandikos CalDAV and CardDAV server");
package = mkPackageOption pkgs "xandikos" { };
address = mkOption {
type = types.str;
default = "localhost";
description = lib.mdDoc ''
The IP address on which Xandikos will listen.
By default listens on localhost.
'';
};
port = mkOption {
type = types.port;
default = 8080;
description = lib.mdDoc "The port of the Xandikos web application";
};
routePrefix = mkOption {
type = types.str;
default = "/";
description = lib.mdDoc ''
Path to Xandikos.
Useful when Xandikos is behind a reverse proxy.
'';
};
extraOptions = mkOption {
default = [];
type = types.listOf types.str;
example = literalExpression ''
[ "--autocreate"
"--defaults"
"--current-user-principal user"
"--dump-dav-xml"
]
'';
description = lib.mdDoc ''
Extra command line arguments to pass to xandikos.
'';
};
nginx = mkOption {
default = {};
description = lib.mdDoc ''
Configuration for nginx reverse proxy.
'';
type = types.submodule {
options = {
enable = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc ''
Configure the nginx reverse proxy settings.
'';
};
hostName = mkOption {
type = types.str;
description = lib.mdDoc ''
The hostname use to setup the virtualhost configuration
'';
};
};
};
};
};
};
config = mkIf cfg.enable (
mkMerge [
{
meta.maintainers = with lib.maintainers; [ _0x4A6F ];
systemd.services.xandikos = {
description = "A Simple Calendar and Contact Server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
User = "xandikos";
Group = "xandikos";
DynamicUser = "yes";
RuntimeDirectory = "xandikos";
StateDirectory = "xandikos";
StateDirectoryMode = "0700";
PrivateDevices = true;
# Sandboxing
CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN";
ProtectSystem = "strict";
ProtectHome = true;
PrivateTmp = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_PACKET AF_NETLINK";
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
ExecStart = ''
${cfg.package}/bin/xandikos \
--directory /var/lib/xandikos \
--listen-address ${cfg.address} \
--port ${toString cfg.port} \
--route-prefix ${cfg.routePrefix} \
${lib.concatStringsSep " " cfg.extraOptions}
'';
};
};
}
(
mkIf cfg.nginx.enable {
services.nginx = {
enable = true;
virtualHosts."${cfg.nginx.hostName}" = {
locations."/" = {
proxyPass = "http://${cfg.address}:${toString cfg.port}/";
};
};
};
}
)
]
);
}