Wire production daemon settings in NixOS module

flake.nix

@@ -14,7 +14,8 @@
     };
   };
 
-  outputs = inputs @ {
+  outputs =
+    inputs@{
       self,
       nixpkgs,
       flake-parts,
@@ -29,22 +30,37 @@
         "aarch64-darwin"
       ];
 
-      perSystem = {
+      perSystem =
+        {
           self',
           pkgs,
           system,
           ...
-      }: let
+        }:
+        let
           rustPkgs = import nixpkgs {
             inherit system;
             overlays = [ (import rust-overlay) ];
           };
           rustToolchain = rustPkgs.rust-bin.stable.latest.default.override {
-          extensions = ["rust-src" "rust-analyzer" "clippy" "rustfmt"];
+            extensions = [
+              "rust-src"
+              "rust-analyzer"
+              "clippy"
+              "rustfmt"
+            ];
           };
-        commonBuildInputs = with pkgs; [openssl sqlite];
+          commonBuildInputs = with pkgs; [
-        commonNativeBuildInputs = with pkgs; [cmake perl pkg-config];
+            openssl
-      in {
+            sqlite
+          ];
+          commonNativeBuildInputs = with pkgs; [
+            cmake
+            perl
+            pkg-config
+          ];
+        in
+        {
           packages = {
             default = pkgs.rustPlatform.buildRustPackage {
               pname = "iota";
@@ -73,7 +89,10 @@
 
             iota-daemon = self'.packages.default.overrideAttrs (old: {
               pname = "iota-daemon";
-            cargoBuildFlags = ["-p" "iota-daemon"];
+              cargoBuildFlags = [
+                "-p"
+                "iota-daemon"
+              ];
               postInstall = ''
                 for f in $out/bin/*; do
                   if [ "$(basename "$f")" != "iota-daemon" ]; then
@@ -85,7 +104,10 @@
 
             iota-ui = self'.packages.default.overrideAttrs (old: {
               pname = "iota-ui";
-            cargoBuildFlags = ["-p" "iota"];
+              cargoBuildFlags = [
+                "-p"
+                "iota"
+              ];
               postInstall = ''
                 for f in $out/bin/*; do
                   if [ "$(basename "$f")" != "iota" ]; then
@@ -100,29 +122,54 @@
           };
 
           devShells.default = pkgs.mkShell {
-          nativeBuildInputs = with pkgs; [rustToolchain git cmake perl pkg-config];
+            nativeBuildInputs = with pkgs; [
+              rustToolchain
+              git
+              cmake
+              perl
+              pkg-config
+            ];
             buildInputs = commonBuildInputs;
           };
         };
 
       flake = {
-        nixosModules.default = {
+        nixosModules.default =
+          {
             config,
             pkgs,
             lib,
             ...
-        }: let
+          }:
+          let
             cfg = config.services.iota;
-          defaultPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.default or (throw "iota: no pre-built package for system ${pkgs.stdenv.hostPlatform.system}");
+            defaultPackage =
+              self.packages.${pkgs.stdenv.hostPlatform.system}.default
+                or (throw "iota: no pre-built package for system ${pkgs.stdenv.hostPlatform.system}");
 
             configFormat = pkgs.formats.yaml { };
+            effectiveSettings = lib.recursiveUpdate {
+              port = cfg.port;
+              web = {
+                mode = "network";
+                bind = cfg.bindAddress;
+                port = cfg.port;
+                required = true;
+              }
+              // lib.optionalAttrs (cfg.certFile != null) {
+                certificate = "${cfg.stateDir}/tls/cert.pem";
+                key = "${cfg.stateDir}/tls/key.pem";
+              };
+            } cfg.settings;
             configFile =
-            if cfg.settingsFile != null
+              if cfg.settingsFile != null then
-            then cfg.settingsFile
+                cfg.settingsFile
-            else configFormat.generate "iota-config.yaml" cfg.settings;
+              else
+                configFormat.generate "iota-config.yaml" effectiveSettings;
 
             descriptionText = "Tensamin Iota daemon";
-        in {
+          in
+          {
             options.services.iota = {
               enable = lib.mkEnableOption "Enable the Iota service.";
 
@@ -131,25 +178,37 @@
                 default = "/var/lib/iota";
                 description = "Persistent mutable Iota state.";
               };
-            cacheDir = lib.mkOption { type = lib.types.str; default = "/var/cache/iota"; };
+              cacheDir = lib.mkOption {
-            runtimeDir = lib.mkOption { type = lib.types.str; default = "/run/iota"; };
+                type = lib.types.str;
-            logDir = lib.mkOption { type = lib.types.str; default = "/var/log/iota"; };
+                default = "/var/cache/iota";
-            assetDir = lib.mkOption { type = lib.types.str; default = "${cfg.package}/share/iota/web"; };
+              };
+              runtimeDir = lib.mkOption {
+                type = lib.types.str;
+                default = "/run/iota";
+              };
+              logDir = lib.mkOption {
+                type = lib.types.str;
+                default = "/var/log/iota";
+              };
+              assetDir = lib.mkOption {
+                type = lib.types.str;
+                default = "${cfg.package}/share/iota/web";
+              };
 
               certFile = lib.mkOption {
-              type = lib.types.nullOr lib.types.path;
+                type = lib.types.nullOr lib.types.str;
                 default = null;
                 description = "Path to the SSL certificate file (cert.pem).";
               };
 
               keyFile = lib.mkOption {
-              type = lib.types.nullOr lib.types.path;
+                type = lib.types.nullOr lib.types.str;
                 default = null;
                 description = "Path to the SSL private key file (cert.key).";
               };
 
               environmentFiles = lib.mkOption {
-              type = lib.types.listOf lib.types.path;
+                type = lib.types.listOf lib.types.str;
                 default = [ ];
                 description = "Environment files to load for the Iota service.";
               };
@@ -166,6 +225,18 @@
                 description = "IP address to bind the HTTP server to.";
               };
 
+              port = lib.mkOption {
+                type = lib.types.port;
+                default = 1984;
+                description = "TCP and UDP port for protocol-only Iota.";
+              };
+
+              omegaApiUrl = lib.mkOption {
+                type = lib.types.str;
+                default = "https://omega.tensamin.net";
+                description = "Omega discovery API URL.";
+              };
+
               package = lib.mkOption {
                 type = lib.types.package;
                 default = defaultPackage;
@@ -186,6 +257,13 @@
             };
 
             config = lib.mkIf cfg.enable {
+              assertions = [
+                {
+                  assertion = (cfg.certFile == null) == (cfg.keyFile == null);
+                  message = "services.iota: certFile and keyFile must be set together.";
+                }
+              ];
+
               users.users.iota = {
                 isSystemUser = true;
                 group = "iota";
@@ -215,11 +293,15 @@
               systemd.services.iota = {
                 description = descriptionText;
                 wantedBy = [ "multi-user.target" ];
-              after = ["network.target" "iota.socket"];
+                after = [
+                  "network.target"
+                  "iota.socket"
+                ];
                 requires = [ "iota.socket" ];
 
-              serviceConfig =
+                environment.OMEGA_API_URL = cfg.omegaApiUrl;
-                {
+
+                serviceConfig = {
                   Type = "simple";
                   User = "iota";
                   Group = "iota";
@@ -251,8 +333,16 @@
                   ProtectHome = true;
                   PrivateTmp = true;
                   NoNewPrivileges = true;
-                  ReadWritePaths = [cfg.stateDir cfg.cacheDir cfg.runtimeDir cfg.logDir];
+                  ReadWritePaths = [
-                  ReadOnlyPaths = [configFile cfg.assetDir];
+                    cfg.stateDir
+                    cfg.cacheDir
+                    cfg.runtimeDir
+                    cfg.logDir
+                  ];
+                  ReadOnlyPaths = [
+                    configFile
+                    cfg.assetDir
+                  ];
                   ProtectKernelTunables = true;
                   ProtectKernelModules = true;
                   ProtectControlGroups = true;
@@ -261,7 +351,6 @@
                   LockPersonality = true;
                   MemoryDenyWriteExecute = true;
                   Environment = [
-                    "BIND_ADDRESS=${cfg.bindAddress}"
                     "IOTA_SOCKET=/run/iota/iota.sock"
                     "IOTA_CONFIG_FILE=${configFile}"
                     "IOTA_STATE_DIR=${cfg.stateDir}"
@@ -273,14 +362,21 @@
                     "IOTA_SUPERVISOR=systemd"
                   ];
                 }
+                // lib.optionalAttrs (cfg.certFile != null) {
+                  ExecStartPre = "+${pkgs.writeShellScript "iota-setup-tls" ''
+                    install -d -m 0700 -o iota -g iota ${cfg.stateDir}/tls
+                    install -m 0644 -o iota -g iota ${cfg.certFile} ${cfg.stateDir}/tls/cert.pem
+                    install -m 0600 -o iota -g iota ${cfg.keyFile} ${cfg.stateDir}/tls/key.pem
+                  ''}";
+                }
                 // lib.optionalAttrs (cfg.environmentFiles != [ ]) {
                   EnvironmentFile = cfg.environmentFiles;
                 };
               };
 
               networking.firewall = lib.mkIf cfg.openFirewall {
-              allowedTCPPorts = [1984];
+                allowedTCPPorts = [ cfg.port ];
-              allowedUDPPorts = [1984];
+                allowedUDPPorts = [ cfg.port ];
               };
             };
           };