move services.helix-player to eth.services

also harden the systemd config.

1 files changed, 54 insertions, 0 deletions

diff --git a/modules/services/helix-player.nix b/modules/services/helix-player.nix
new file mode 100644
index 0000000..977e263
--- /dev/null
+++ b/modules/services/helix-player.nix
@@ -0,0 +1,54 @@
+{ config, lib, pkgs, ... }:
+with lib;
+
+let
+
+  cfg = config.eth.services.helix-player;
+
+  systemdDirectoryName = "helix-player";
+  runtimeDirectory = "/run/${systemdDirectoryName}";
+  socket = "${runtimeDirectory}/listen.sock";
+
+in {
+
+  options.eth.services.helix-player = {
+
+    enable = mkEnableOption "Whether to enable helix-player";
+
+    socket = mkOption {
+      type = types.str;
+      readOnly = true;
+      description = "Path of the UNIX socket to listen on.";
+      example = socket;
+    };
+  };
+
+
+  config = mkIf cfg.enable {
+
+    eth.services.helix-player.socket = socket;
+
+    systemd.services.helix-player = {
+      enable = true;
+      description = "Helix UPnP player & controller";
+      wants = [ "network.target" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        Group = config.services.nginx.group;
+
+        RuntimeDirectory = systemdDirectoryName;
+
+        ExecStart = "${pkgs.eth.helix}/bin/helix-player -socket ${socket}";
+
+        NoNewPrivileges = true;
+        ProtectHome = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+      };
+    };
+  };
+
+}