47 lines
1.2 KiB
Nix
47 lines
1.2 KiB
Nix
{ pkgs, ... }:
|
|
{
|
|
environment.systemPackages = [
|
|
pkgs.signal-cli
|
|
];
|
|
|
|
users = {
|
|
groups.signal-cli = { };
|
|
users.signal-cli = {
|
|
isSystemUser = true;
|
|
group = "signal-cli";
|
|
home = "/var/lib/signal-cli";
|
|
};
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/signal-cli 0700 signal-cli signal-cli - -"
|
|
"Z /var/lib/signal-cli - signal-cli signal-cli - -"
|
|
];
|
|
|
|
systemd.services.signal-cli = {
|
|
description = "Signal CLI JSON-RPC service";
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
unitConfig.RequiresMountsFor = [ "/var/lib/signal-cli" ];
|
|
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = "signal-cli";
|
|
Group = "signal-cli";
|
|
ExecStart = "${pkgs.signal-cli}/bin/signal-cli --data-dir /var/lib/signal-cli daemon --socket /run/signal-cli/socket";
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
SuccessExitStatus = 143;
|
|
RuntimeDirectory = "signal-cli";
|
|
RuntimeDirectoryMode = "0750";
|
|
UMask = "0007";
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectHome = true;
|
|
ProtectSystem = "strict";
|
|
ReadWritePaths = [ "/var/lib/signal-cli" ];
|
|
};
|
|
};
|
|
}
|