pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6 cfg = config.services.resilio;
7
8 resilioSync = pkgs.resilio-sync;
9
10 sharedFoldersRecord = map (entry: {
11 secret = entry.secret;
12 dir = entry.directory;
13
14 use_relay_server = entry.useRelayServer;
15 use_tracker = entry.useTracker;
16 use_dht = entry.useDHT;
17
18 search_lan = entry.searchLAN;
19 use_sync_trash = entry.useSyncTrash;
20 known_hosts = entry.knownHosts;
21 }) cfg.sharedFolders;
22
23 configFile = pkgs.writeText "config.json" (builtins.toJSON ({
24 device_name = cfg.deviceName;
25 storage_path = cfg.storagePath;
26 listening_port = cfg.listeningPort;
27 use_gui = false;
28 check_for_updates = cfg.checkForUpdates;
29 use_upnp = cfg.useUpnp;
30 download_limit = cfg.downloadLimit;
31 upload_limit = cfg.uploadLimit;
32 lan_encrypt_data = cfg.encryptLAN;
33 } // optionalAttrs (cfg.directoryRoot != "") { directory_root = cfg.directoryRoot; }
34 // optionalAttrs cfg.enableWebUI {
35 webui = { listen = "${cfg.httpListenAddr}:${toString cfg.httpListenPort}"; } //
36 (optionalAttrs (cfg.httpLogin != "") { login = cfg.httpLogin; }) //
37 (optionalAttrs (cfg.httpPass != "") { password = cfg.httpPass; }) //
38 (optionalAttrs (cfg.apiKey != "") { api_key = cfg.apiKey; });
39 } // optionalAttrs (sharedFoldersRecord != []) {
40 shared_folders = sharedFoldersRecord;
41 }));
42
43in
44{
45 options = {
46 services.resilio = {
47 enable = mkOption {
48 type = types.bool;
49 default = false;
50 description = ''
51 If enabled, start the Resilio Sync daemon. Once enabled, you can
52 interact with the service through the Web UI, or configure it in your
53 NixOS configuration.
54 '';
55 };
56
57 deviceName = mkOption {
58 type = types.str;
59 example = "Voltron";
60 default = config.networking.hostName;
61 description = ''
62 Name of the Resilio Sync device.
63 '';
64 };
65
66 listeningPort = mkOption {
67 type = types.int;
68 default = 0;
69 example = 44444;
70 description = ''
71 Listening port. Defaults to 0 which randomizes the port.
72 '';
73 };
74
75 checkForUpdates = mkOption {
76 type = types.bool;
77 default = true;
78 description = ''
79 Determines whether to check for updates and alert the user
80 about them in the UI.
81 '';
82 };
83
84 useUpnp = mkOption {
85 type = types.bool;
86 default = true;
87 description = ''
88 Use Universal Plug-n-Play (UPnP)
89 '';
90 };
91
92 downloadLimit = mkOption {
93 type = types.int;
94 default = 0;
95 example = 1024;
96 description = ''
97 Download speed limit. 0 is unlimited (default).
98 '';
99 };
100
101 uploadLimit = mkOption {
102 type = types.int;
103 default = 0;
104 example = 1024;
105 description = ''
106 Upload speed limit. 0 is unlimited (default).
107 '';
108 };
109
110 httpListenAddr = mkOption {
111 type = types.str;
112 default = "[::1]";
113 example = "0.0.0.0";
114 description = ''
115 HTTP address to bind to.
116 '';
117 };
118
119 httpListenPort = mkOption {
120 type = types.int;
121 default = 9000;
122 description = ''
123 HTTP port to bind on.
124 '';
125 };
126
127 httpLogin = mkOption {
128 type = types.str;
129 example = "allyourbase";
130 default = "";
131 description = ''
132 HTTP web login username.
133 '';
134 };
135
136 httpPass = mkOption {
137 type = types.str;
138 example = "arebelongtous";
139 default = "";
140 description = ''
141 HTTP web login password.
142 '';
143 };
144
145 encryptLAN = mkOption {
146 type = types.bool;
147 default = true;
148 description = "Encrypt LAN data.";
149 };
150
151 enableWebUI = mkOption {
152 type = types.bool;
153 default = false;
154 description = ''
155 Enable Web UI for administration. Bound to the specified
156 <literal>httpListenAddress</literal> and
157 <literal>httpListenPort</literal>.
158 '';
159 };
160
161 storagePath = mkOption {
162 type = types.path;
163 default = "/var/lib/resilio-sync/";
164 description = ''
165 Where BitTorrent Sync will store it's database files (containing
166 things like username info and licenses). Generally, you should not
167 need to ever change this.
168 '';
169 };
170
171 apiKey = mkOption {
172 type = types.str;
173 default = "";
174 description = "API key, which enables the developer API.";
175 };
176
177 directoryRoot = mkOption {
178 type = types.str;
179 default = "";
180 example = "/media";
181 description = "Default directory to add folders in the web UI.";
182 };
183
184 sharedFolders = mkOption {
185 default = [];
186 type = types.listOf (types.attrsOf types.anything);
187 example =
188 [ { secret = "AHMYFPCQAHBM7LQPFXQ7WV6Y42IGUXJ5Y";
189 directory = "/home/user/sync_test";
190 useRelayServer = true;
191 useTracker = true;
192 useDHT = false;
193 searchLAN = true;
194 useSyncTrash = true;
195 knownHosts = [
196 "192.168.1.2:4444"
197 "192.168.1.3:4444"
198 ];
199 }
200 ];
201 description = ''
202 Shared folder list. If enabled, web UI must be
203 disabled. Secrets can be generated using <literal>rslsync
204 --generate-secret</literal>. Note that this secret will be
205 put inside the Nix store, so it is realistically not very
206 secret.
207
208 If you would like to be able to modify the contents of this
209 directories, it is recommended that you make your user a
210 member of the <literal>rslsync</literal> group.
211
212 Directories in this list should be in the
213 <literal>rslsync</literal> group, and that group must have
214 write access to the directory. It is also recommended that
215 <literal>chmod g+s</literal> is applied to the directory
216 so that any sub directories created will also belong to
217 the <literal>rslsync</literal> group. Also,
218 <literal>setfacl -d -m group:rslsync:rwx</literal> and
219 <literal>setfacl -m group:rslsync:rwx</literal> should also
220 be applied so that the sub directories are writable by
221 the group.
222 '';
223 };
224 };
225 };
226
227 config = mkIf cfg.enable {
228 assertions =
229 [ { assertion = cfg.deviceName != "";
230 message = "Device name cannot be empty.";
231 }
232 { assertion = cfg.enableWebUI -> cfg.sharedFolders == [];
233 message = "If using shared folders, the web UI cannot be enabled.";
234 }
235 { assertion = cfg.apiKey != "" -> cfg.enableWebUI;
236 message = "If you're using an API key, you must enable the web server.";
237 }
238 ];
239
240 users.users.rslsync = {
241 description = "Resilio Sync Service user";
242 home = cfg.storagePath;
243 createHome = true;
244 uid = config.ids.uids.rslsync;
245 group = "rslsync";
246 };
247
248 users.groups.rslsync = {};
249
250 systemd.services.resilio = with pkgs; {
251 description = "Resilio Sync Service";
252 wantedBy = [ "multi-user.target" ];
253 after = [ "network.target" ];
254 serviceConfig = {
255 Restart = "on-abort";
256 UMask = "0002";
257 User = "rslsync";
258 ExecStart = ''
259 ${resilioSync}/bin/rslsync --nodaemon --config ${configFile}
260 '';
261 };
262 };
263 };
264}