Add projects

nix/module.nix

@@ -0,0 +1,233 @@
+{ self }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
+  cfg = config.services.vibe-proxy;
+  statePath = "/var/lib/${cfg.stateDirectory}";
+  yaml = pkgs.formats.yaml { };
+  generatedSettings =
+    lib.recursiveUpdate
+      (
+        {
+          host = cfg.host;
+          port = cfg.port;
+          auth-dir = "${statePath}/auths";
+          plugins = {
+            enabled = true;
+            dir = "${statePath}/plugins";
+          };
+        }
+        // cfg.settings
+      )
+      {
+        host = cfg.host;
+        port = cfg.port;
+      };
+  generatedConfig = yaml.generate "vibe-proxy.yaml" generatedSettings;
+  runtimeConfig =
+    if cfg.configFile == null then "${statePath}/config.yaml" else toString cfg.configFile;
+in
+{
+  options.services.vibe-proxy = {
+    enable = mkEnableOption "Vibe Proxy";
+
+    package = mkOption {
+      type = types.package;
+      default = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
+      defaultText = lib.literalExpression "inputs.vibe-proxy.packages.${pkgs.stdenv.hostPlatform.system}.default";
+      description = "Vibe Proxy package to run.";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "vibe-proxy";
+      description = "User account under which the service runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "vibe-proxy";
+      description = "Group under which the service runs.";
+    };
+
+    stateDirectory = mkOption {
+      type = types.str;
+      default = "vibe-proxy";
+      description = "Directory below /var/lib used for writable service state.";
+    };
+
+    host = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = "Address on which the API listens.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8317;
+      description = "TCP port on which the API listens.";
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to open the main API port in the firewall.";
+    };
+
+    configFile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Writable external configuration file. When null, settings generate the configuration on every service start.";
+    };
+
+    settings = mkOption {
+      type = yaml.type;
+      default = { };
+      description = "Declarative YAML configuration. Secrets in this option are written to the Nix store; use environmentFiles for secrets.";
+    };
+
+    environment = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      description = "Non-secret environment variables for the service.";
+    };
+
+    environmentFiles = mkOption {
+      type = types.listOf types.path;
+      default = [ ];
+      description = "Environment files containing secrets such as MANAGEMENT_PASSWORD.";
+    };
+
+    localModel = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Disable remote model catalog updates.";
+    };
+
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "Additional command-line arguments passed to the server.";
+    };
+
+    openOAuthCallbackPorts = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Open the built-in OAuth callback ports 1455, 54545, and 51121.";
+    };
+
+    liveMediaRelay = {
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open the configured UDP range for the live-media relay.";
+      };
+      portRange = mkOption {
+        type = types.submodule {
+          options = {
+            from = mkOption {
+              type = types.port;
+              default = 50000;
+            };
+            to = mkOption {
+              type = types.port;
+              default = 50100;
+            };
+          };
+        };
+        default = { };
+        description = "UDP firewall range used by the live-media relay.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.liveMediaRelay.portRange.from <= cfg.liveMediaRelay.portRange.to;
+        message = "services.vibe-proxy.liveMediaRelay.portRange.from must not exceed .to";
+      }
+    ];
+
+    users.groups = mkIf (cfg.group == "vibe-proxy") {
+      vibe-proxy = { };
+    };
+    users.users = mkIf (cfg.user == "vibe-proxy") {
+      vibe-proxy = {
+        isSystemUser = true;
+        inherit (cfg) group;
+        home = statePath;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts =
+      lib.optional cfg.openFirewall cfg.port
+      ++ lib.optionals cfg.openOAuthCallbackPorts [
+        1455
+        51121
+        54545
+      ];
+    networking.firewall.allowedUDPPortRanges = lib.optional cfg.liveMediaRelay.openFirewall {
+      inherit (cfg.liveMediaRelay.portRange) from to;
+    };
+
+    systemd.services.vibe-proxy = {
+      description = "Vibe Proxy API";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+
+      environment = {
+        HOME = statePath;
+        WRITABLE_PATH = statePath;
+      }
+      // cfg.environment;
+
+      preStart = ''
+        ln -sfn ${cfg.package}/share/vibe-proxy/config.example.yaml ${statePath}/config.example.yaml
+      ''
+      + lib.optionalString (cfg.configFile == null) ''
+        install -m 0600 ${generatedConfig} ${runtimeConfig}
+      '';
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = cfg.stateDirectory;
+        StateDirectoryMode = "0700";
+        WorkingDirectory = statePath;
+        EnvironmentFile = cfg.environmentFiles;
+        ExecStart = lib.concatStringsSep " " (
+          [
+            (lib.getExe cfg.package)
+            "--config"
+            (lib.escapeShellArg runtimeConfig)
+          ]
+          ++ lib.optional cfg.localModel "--local-model"
+          ++ map lib.escapeShellArg cfg.extraArgs
+        );
+        Restart = "on-failure";
+        RestartSec = "5s";
+        UMask = "0077";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ReadWritePaths = [
+          statePath
+        ]
+        ++ lib.optional (cfg.configFile != null) (builtins.dirOf cfg.configFile);
+      };
+    };
+  };
+}