Add NixOS flake with dev shell, package, and systemd module
Includes nix develop shell (node, pg, vips), buildNpmPackage derivation, and a NixOS module for deploying as a systemd service with hardening, dedicated user, and configurable secrets via environmentFile. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -5,3 +5,5 @@ build
|
||||
static/uploads/**
|
||||
!static/uploads/.gitkeep
|
||||
*.db
|
||||
result
|
||||
.direnv
|
||||
|
||||
@@ -98,6 +98,77 @@ npm run build
|
||||
npm run preview
|
||||
```
|
||||
|
||||
## NixOS
|
||||
|
||||
This project includes a Nix flake with a dev shell, package, and NixOS module.
|
||||
|
||||
### Development shell
|
||||
|
||||
```bash
|
||||
nix develop
|
||||
npm install
|
||||
npm run dev
|
||||
```
|
||||
|
||||
Or with direnv (`.envrc` is included):
|
||||
|
||||
```bash
|
||||
direnv allow
|
||||
npm install
|
||||
npm run dev
|
||||
```
|
||||
|
||||
### Build with Nix
|
||||
|
||||
```bash
|
||||
nix build
|
||||
```
|
||||
|
||||
### NixOS module (deploy as a service)
|
||||
|
||||
Add this flake to your NixOS configuration inputs, then:
|
||||
|
||||
```nix
|
||||
# flake.nix
|
||||
{
|
||||
inputs.buildfor-life-repair.url = "git+https://git.b4l.co.th/B4L/buildfor_life_repair.git";
|
||||
}
|
||||
```
|
||||
|
||||
```nix
|
||||
# configuration.nix
|
||||
{ inputs, ... }:
|
||||
{
|
||||
imports = [ inputs.buildfor-life-repair.nixosModules.default ];
|
||||
|
||||
services.buildfor-life-repair = {
|
||||
enable = true;
|
||||
port = 3000;
|
||||
databaseUrl = "postgresql://bflr:password@localhost:5432/buildfor_life_repair";
|
||||
baseUrl = "https://repair.example.com";
|
||||
openFirewall = true;
|
||||
};
|
||||
}
|
||||
```
|
||||
|
||||
Or use an environment file for secrets:
|
||||
|
||||
```nix
|
||||
services.buildfor-life-repair = {
|
||||
enable = true;
|
||||
port = 3000;
|
||||
environmentFile = "/run/secrets/bflr-env"; # contains DATABASE_URL=...
|
||||
baseUrl = "https://repair.example.com";
|
||||
};
|
||||
```
|
||||
|
||||
The module creates a systemd service with:
|
||||
- Dedicated `bflr` user/group
|
||||
- Upload directory at `/var/lib/buildfor-life-repair/uploads`
|
||||
- Systemd hardening (NoNewPrivileges, ProtectSystem, PrivateTmp)
|
||||
- Auto-restart on failure
|
||||
- Optional firewall rule
|
||||
|
||||
## Tech stack
|
||||
|
||||
- **Frontend:** SvelteKit 5, Svelte 5 (runes), Tailwind CSS v4
|
||||
|
||||
@@ -0,0 +1,202 @@
|
||||
{
|
||||
description = "buildfor_life_repair - Vintage equipment inventory & repair tracker";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, flake-utils }:
|
||||
flake-utils.lib.eachDefaultSystem (system:
|
||||
let
|
||||
pkgs = import nixpkgs { inherit system; };
|
||||
nodejs = pkgs.nodejs_20;
|
||||
in
|
||||
{
|
||||
# Development shell: `nix develop`
|
||||
devShells.default = pkgs.mkShell {
|
||||
buildInputs = [
|
||||
nodejs
|
||||
pkgs.postgresql_16
|
||||
pkgs.pkg-config
|
||||
pkgs.vips # required by sharp
|
||||
];
|
||||
|
||||
shellHook = ''
|
||||
echo "buildfor_life_repair dev shell"
|
||||
echo " node: $(node --version)"
|
||||
echo " npm: $(npm --version)"
|
||||
echo ""
|
||||
echo "Run 'npm install' then 'npm run dev' to start."
|
||||
'';
|
||||
};
|
||||
|
||||
# Production package: `nix build`
|
||||
packages.default = pkgs.buildNpmPackage rec {
|
||||
pname = "buildfor_life_repair";
|
||||
version = "0.1.0";
|
||||
|
||||
src = ./.;
|
||||
|
||||
npmDepsHash = ""; # Run `nix build` once to get the correct hash
|
||||
|
||||
nativeBuildInputs = [
|
||||
pkgs.pkg-config
|
||||
pkgs.python3 # needed by some native modules
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
pkgs.vips # sharp
|
||||
pkgs.glib
|
||||
pkgs.expat
|
||||
];
|
||||
|
||||
npmBuildScript = "build";
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
mkdir -p $out/lib/buildfor_life_repair
|
||||
cp -r build/* $out/lib/buildfor_life_repair/
|
||||
cp -r node_modules $out/lib/buildfor_life_repair/
|
||||
cp package.json $out/lib/buildfor_life_repair/
|
||||
|
||||
mkdir -p $out/bin
|
||||
cat > $out/bin/buildfor_life_repair <<EOF
|
||||
#!/usr/bin/env bash
|
||||
exec ${nodejs}/bin/node $out/lib/buildfor_life_repair/index.js "\$@"
|
||||
EOF
|
||||
chmod +x $out/bin/buildfor_life_repair
|
||||
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
meta = with pkgs.lib; {
|
||||
description = "Vintage equipment inventory & repair tracker";
|
||||
license = licenses.mit;
|
||||
platforms = platforms.linux;
|
||||
};
|
||||
};
|
||||
}
|
||||
) // {
|
||||
# NixOS module for easy deployment
|
||||
nixosModules.default = { config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.buildfor-life-repair;
|
||||
in
|
||||
{
|
||||
options.services.buildfor-life-repair = {
|
||||
enable = lib.mkEnableOption "buildfor_life_repair inventory system";
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 3000;
|
||||
description = "Port to listen on";
|
||||
};
|
||||
|
||||
host = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "0.0.0.0";
|
||||
description = "Host to bind to";
|
||||
};
|
||||
|
||||
databaseUrl = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "PostgreSQL connection string";
|
||||
example = "postgresql://bflr:password@localhost:5432/buildfor_life_repair";
|
||||
};
|
||||
|
||||
environmentFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
default = null;
|
||||
description = "Path to environment file with secrets (DATABASE_URL, etc). Overrides databaseUrl if set.";
|
||||
};
|
||||
|
||||
baseUrl = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "http://localhost:${toString cfg.port}";
|
||||
description = "Public base URL for QR code generation";
|
||||
};
|
||||
|
||||
uploadDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/buildfor-life-repair/uploads";
|
||||
description = "Directory for uploaded images and documents";
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "bflr";
|
||||
description = "System user to run the service as";
|
||||
};
|
||||
|
||||
group = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "bflr";
|
||||
description = "System group to run the service as";
|
||||
};
|
||||
|
||||
openFirewall = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open the firewall port";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
users.users.${cfg.user} = {
|
||||
isSystemUser = true;
|
||||
group = cfg.group;
|
||||
home = "/var/lib/buildfor-life-repair";
|
||||
createHome = true;
|
||||
};
|
||||
|
||||
users.groups.${cfg.group} = {};
|
||||
|
||||
systemd.services.buildfor-life-repair = {
|
||||
description = "buildfor_life_repair inventory system";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" "postgresql.service" ];
|
||||
|
||||
environment = {
|
||||
NODE_ENV = "production";
|
||||
PORT = toString cfg.port;
|
||||
HOST = cfg.host;
|
||||
BASE_URL = cfg.baseUrl;
|
||||
UPLOAD_DIR = cfg.uploadDir;
|
||||
} // lib.optionalAttrs (cfg.environmentFile == null) {
|
||||
DATABASE_URL = cfg.databaseUrl;
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
WorkingDirectory = "/var/lib/buildfor-life-repair";
|
||||
ExecStart = "${self.packages.${pkgs.system}.default}/bin/buildfor_life_repair";
|
||||
Restart = "on-failure";
|
||||
RestartSec = 5;
|
||||
|
||||
# Hardening
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ReadWritePaths = [ cfg.uploadDir "/var/lib/buildfor-life-repair" ];
|
||||
PrivateTmp = true;
|
||||
} // lib.optionalAttrs (cfg.environmentFile != null) {
|
||||
EnvironmentFile = cfg.environmentFile;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${cfg.uploadDir} 0750 ${cfg.user} ${cfg.group} -"
|
||||
"d ${cfg.uploadDir}/devices 0750 ${cfg.user} ${cfg.group} -"
|
||||
"d ${cfg.uploadDir}/components 0750 ${cfg.user} ${cfg.group} -"
|
||||
"d ${cfg.uploadDir}/documents 0750 ${cfg.user} ${cfg.group} -"
|
||||
];
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user