@@ -0,0 +1,88 @@
1+{ config, lib, pkgs, ... }:
2+
3+with lib;
4+let
5+
6+ cfg = config.services.prosody-filer;
7+
8+ settingsFormat = pkgs.formats.toml { };
9+ configFile = settingsFormat.generate "prosody-filer.toml" cfg.settings;
10+in {
11+
12+ options = {
13+ services.prosody-filer = {
14+ enable = mkEnableOption "Prosody Filer XMPP upload file server";
15+
16+ settings = mkOption {
17+ description = ''
18+ Configuration for Prosody Filer.
19+ Refer to <link xlink:href="https://github.com/ThomasLeister/prosody-filer#configure-prosody-filer"/> for details on supported values.
20+ '';
21+
22+ type = settingsFormat.type;
23+
24+ example = literalExample ''
25+ {
26+ secret = "mysecret";
27+ storeDir = "/srv/http/nginx/prosody-upload";
28+ }
29+ '';
30+
31+ defaultText = literalExpression ''
32+ {
33+ listenport = mkDefault "127.0.0.1:5050";
34+ uploadSubDir = mkDefault "upload/";
35+ }
36+ '';
37+ };
38+ };
39+ };
40+
41+ config = mkIf cfg.enable {
42+ services.prosody-filer.settings = {
43+ listenport = mkDefault "127.0.0.1:5050";
44+ uploadSubDir = mkDefault "upload/";
45+ };
46+
47+ users.users.prosody-filer = {
48+ group = "prosody-filer";
49+ isSystemUser = true;
50+ };
51+
52+ users.groups.prosody-filer = { };
53+
54+ systemd.services.prosody-filer = {
55+ description = "Prosody file upload server";
56+ wantedBy = [ "multi-user.target" ];
57+ after = [ "network.target" ];
58+
59+ serviceConfig = {
60+ User = "prosody-filer";
61+ Group = "prosody-filer";
62+ ExecStart = "${pkgs.prosody-filer}/bin/prosody-filer -config ${configFile}";
63+ Restart = "on-failure";
64+ CapabilityBoundingSet = "";
65+ NoNewPrivileges = true;
66+ PrivateDevices = true;
67+ PrivateTmp = true;
68+ PrivateMounts = true;
69+ ProtectHome = true;
70+ ProtectClock = true;
71+ ProtectProc = "noaccess";
72+ ProcSubset = "pid";
73+ ProtectKernelLogs = true;
74+ ProtectKernelModules = true;
75+ ProtectKernelTunables = true;
76+ ProtectControlGroups = true;
77+ ProtectHostname = true;
78+ RestrictSUIDSGID = true;
79+ RestrictRealtime = true;
80+ RestrictNamespaces = true;
81+ LockPersonality = true;
82+ RemoveIPC = true;
83+ RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
84+ SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
85+ };
86+ };
87+ };
88+}