Richie
7f08a6f788
- move HAProxy and ACME certificate management to Portal - route application backends to Jeeves over Tailscale - restrict Jeeves backend ports to the Tailscale interface - expose Gems for remote proxy access
53 lines
1.2 KiB
Nix
53 lines
1.2 KiB
Nix
{
|
|
inputs,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
vars = import ../vars.nix;
|
|
stateDir = "${vars.services}/gems";
|
|
in
|
|
{
|
|
users.groups.gems = { };
|
|
users.users.gems = {
|
|
isSystemUser = true;
|
|
group = "gems";
|
|
home = stateDir;
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d ${stateDir} 0750 gems gems - -"
|
|
];
|
|
|
|
systemd.services.gems = {
|
|
description = "Gems multiplayer game";
|
|
after = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
environment = {
|
|
PYTHONPATH = "${inputs.self}";
|
|
GEMS_DATABASE_PATH = "${stateDir}/gems.sqlite3";
|
|
GEMS_KEY_PATH = "${stateDir}/instance.key";
|
|
GEMS_PUBLIC_ORIGIN = "https://gems.tmmworkshop.com";
|
|
GEMS_SECURE_COOKIES = "true";
|
|
};
|
|
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = "gems";
|
|
Group = "gems";
|
|
ExecStart = "${pkgs.my_python}/bin/python -m python.gems.main --host 0.0.0.0 --port 8002";
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
StandardOutput = "journal";
|
|
StandardError = "journal";
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectHome = true;
|
|
ProtectSystem = "strict";
|
|
ReadOnlyPaths = [ "${inputs.self}" ];
|
|
ReadWritePaths = [ stateDir ];
|
|
};
|
|
};
|
|
}
|