From 8096ed8c66f08afa02714f3660f8539d48f08da8 Mon Sep 17 00:00:00 2001
From: Ethel Morgan <eth@ethulhu.co.uk>
Date: Sun, 24 May 2020 11:49:03 +0100
Subject: move services.helix-player to eth.services

also harden the systemd config.
---
 module-list.nix                   |  2 +-
 modules/helix-player.nix          | 50 ------------------------------------
 modules/services/helix-player.nix | 54 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+), 51 deletions(-)
 delete mode 100644 modules/helix-player.nix
 create mode 100644 modules/services/helix-player.nix

diff --git a/module-list.nix b/module-list.nix
index c24ae39..7ec267e 100644
--- a/module-list.nix
+++ b/module-list.nix
@@ -1,8 +1,8 @@
 [
-  ./modules/helix-player.nix
   ./modules/keyboard.nix
   ./modules/linode.nix
   ./modules/overlays.nix
+  ./modules/services/helix-player.nix
   ./modules/services/mosquitto.nix
   ./modules/services/snapclient.nix
   ./modules/services/upmpdcli.nix
diff --git a/modules/helix-player.nix b/modules/helix-player.nix
deleted file mode 100644
index d73fc16..0000000
--- a/modules/helix-player.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{ config, lib, pkgs, ... }:
-with lib;
-
-let
-
-  cfg = config.services.helix-player;
-  helixPackage = pkgs.eth.helix;
-
-  runtimeDirectory = "helix-player";
-  socket = "/run/${runtimeDirectory}/listen.sock";
-
-in {
-
-  options.services.helix-player = {
-
-    enable = mkEnableOption "Whether to enable helix-player";
-
-    socket = mkOption {
-      type = types.str;
-      readOnly = true;
-      description = "Path of the UNIX socket to listen on.";
-      example = socket;
-    };
-  };
-
-
-  config = mkIf cfg.enable {
-
-    services.helix-player.socket = socket;
-
-    environment.systemPackages = [
-      helixPackage
-    ];
-
-    systemd.services.helix-player = {
-      enable = true;
-      description = "Helix UPnP player & controller";
-      wants = [ "network.target" ];
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        DynamicUser = "yes";
-        Group = config.services.nginx.group;
-        RuntimeDirectory = "${runtimeDirectory}";
-        ExecStart = "${helixPackage}/bin/helix-player -socket ${socket}";
-      };
-    };
-  };
-
-}
diff --git a/modules/services/helix-player.nix b/modules/services/helix-player.nix
new file mode 100644
index 0000000..977e263
--- /dev/null
+++ b/modules/services/helix-player.nix
@@ -0,0 +1,54 @@
+{ config, lib, pkgs, ... }:
+with lib;
+
+let
+
+  cfg = config.eth.services.helix-player;
+
+  systemdDirectoryName = "helix-player";
+  runtimeDirectory = "/run/${systemdDirectoryName}";
+  socket = "${runtimeDirectory}/listen.sock";
+
+in {
+
+  options.eth.services.helix-player = {
+
+    enable = mkEnableOption "Whether to enable helix-player";
+
+    socket = mkOption {
+      type = types.str;
+      readOnly = true;
+      description = "Path of the UNIX socket to listen on.";
+      example = socket;
+    };
+  };
+
+
+  config = mkIf cfg.enable {
+
+    eth.services.helix-player.socket = socket;
+
+    systemd.services.helix-player = {
+      enable = true;
+      description = "Helix UPnP player & controller";
+      wants = [ "network.target" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        Group = config.services.nginx.group;
+
+        RuntimeDirectory = systemdDirectoryName;
+
+        ExecStart = "${pkgs.eth.helix}/bin/helix-player -socket ${socket}";
+
+        NoNewPrivileges = true;
+        ProtectHome = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+      };
+    };
+  };
+
+}
-- 
cgit v1.2.3