pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6 cfg = config.services.changedetection-io;
7in
8{
9 options.services.changedetection-io = {
10 enable = mkEnableOption (lib.mdDoc "changedetection-io");
11
12 user = mkOption {
13 default = "changedetection-io";
14 type = types.str;
15 description = lib.mdDoc ''
16 User account under which changedetection-io runs.
17 '';
18 };
19
20 group = mkOption {
21 default = "changedetection-io";
22 type = types.str;
23 description = lib.mdDoc ''
24 Group account under which changedetection-io runs.
25 '';
26 };
27
28 listenAddress = mkOption {
29 type = types.str;
30 default = "localhost";
31 description = lib.mdDoc "Address the server will listen on.";
32 };
33
34 port = mkOption {
35 type = types.port;
36 default = 5000;
37 description = lib.mdDoc "Port the server will listen on.";
38 };
39
40 datastorePath = mkOption {
41 type = types.str;
42 default = "/var/lib/changedetection-io";
43 description = lib.mdDoc ''
44 The directory used to store all data for changedetection-io.
45 '';
46 };
47
48 baseURL = mkOption {
49 type = types.nullOr types.str;
50 default = null;
51 example = "https://changedetection-io.example";
52 description = lib.mdDoc ''
53 The base url used in notifications and `{base_url}` token.
54 '';
55 };
56
57 behindProxy = mkOption {
58 type = types.bool;
59 default = false;
60 description = lib.mdDoc ''
61 Enable this option when changedetection-io runs behind a reverse proxy, so that it trusts X-* headers.
62 It is recommend to run changedetection-io behind a TLS reverse proxy.
63 '';
64 };
65
66 environmentFile = mkOption {
67 type = types.nullOr types.path;
68 default = null;
69 example = "/run/secrets/changedetection-io.env";
70 description = lib.mdDoc ''
71 Securely pass environment variabels to changedetection-io.
72
73 This can be used to set for example a frontend password reproducible via `SALTED_PASS`
74 which convinetly also deactivates nags about the hosted version.
75 `SALTED_PASS` should be 64 characters long while the first 32 are the salt and the second the frontend password.
76 It can easily be retrieved from the settings file when first set via the frontend with the following command:
77 ``jq -r .settings.application.password /var/lib/changedetection-io/url-watches.json``
78 '';
79 };
80
81 webDriverSupport = mkOption {
82 type = types.bool;
83 default = false;
84 description = lib.mdDoc ''
85 Enable support for fetching web pages using WebDriver and Chromium.
86 This starts a headless chromium controlled by puppeteer in an oci container.
87
88 ::: {.note}
89 Playwright can currently leak memory.
90 See https://github.com/dgtlmoon/changedetection.io/wiki/Playwright-content-fetcher#playwright-memory-leak
91 :::
92 '';
93 };
94
95 playwrightSupport = mkOption {
96 type = types.bool;
97 default = false;
98 description = lib.mdDoc ''
99 Enable support for fetching web pages using playwright and Chromium.
100 This starts a headless Chromium controlled by puppeteer in an oci container.
101
102 ::: {.note}
103 Playwright can currently leak memory.
104 See https://github.com/dgtlmoon/changedetection.io/wiki/Playwright-content-fetcher#playwright-memory-leak
105 :::
106 '';
107 };
108
109 chromePort = mkOption {
110 type = types.port;
111 default = 4444;
112 description = lib.mdDoc ''
113 A free port on which webDriverSupport or playwrightSupport listen on localhost.
114 '';
115 };
116 };
117
118 config = mkIf cfg.enable {
119 assertions = [
120 {
121 assertion = !((cfg.webDriverSupport == true) && (cfg.playwrightSupport == true));
122 message = "'services.changedetection-io.webDriverSupport' and 'services.changedetection-io.playwrightSupport' cannot be used together.";
123 }
124 ];
125
126 systemd = let
127 defaultStateDir = cfg.datastorePath == "/var/lib/changedetection-io";
128 in {
129 services.changedetection-io = {
130 wantedBy = [ "multi-user.target" ];
131 after = [ "network.target" ];
132 preStart = ''
133 mkdir -p ${cfg.datastorePath}
134 '';
135 serviceConfig = {
136 User = cfg.user;
137 Group = cfg.group;
138 StateDirectory = mkIf defaultStateDir "changedetection-io";
139 StateDirectoryMode = mkIf defaultStateDir "0750";
140 WorkingDirectory = cfg.datastorePath;
141 Environment = lib.optional (cfg.baseURL != null) "BASE_URL=${cfg.baseURL}"
142 ++ lib.optional cfg.behindProxy "USE_X_SETTINGS=1"
143 ++ lib.optional cfg.webDriverSupport "WEBDRIVER_URL=http://127.0.0.1:${toString cfg.chromePort}/wd/hub"
144 ++ lib.optional cfg.playwrightSupport "PLAYWRIGHT_DRIVER_URL=ws://127.0.0.1:${toString cfg.chromePort}/?stealth=1&--disable-web-security=true";
145 EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
146 ExecStart = ''
147 ${pkgs.changedetection-io}/bin/changedetection.py \
148 -h ${cfg.listenAddress} -p ${toString cfg.port} -d ${cfg.datastorePath}
149 '';
150 ProtectHome = true;
151 ProtectSystem = true;
152 Restart = "on-failure";
153 };
154 };
155 tmpfiles.rules = mkIf defaultStateDir [
156 "d ${cfg.datastorePath} 0750 ${cfg.user} ${cfg.group} - -"
157 ];
158 };
159
160 users = {
161 users = optionalAttrs (cfg.user == "changedetection-io") {
162 "changedetection-io" = {
163 isSystemUser = true;
164 group = "changedetection-io";
165 };
166 };
167
168 groups = optionalAttrs (cfg.group == "changedetection-io") {
169 "changedetection-io" = { };
170 };
171 };
172
173 virtualisation = {
174 oci-containers.containers = lib.mkMerge [
175 (mkIf cfg.webDriverSupport {
176 changedetection-io-webdriver = {
177 image = "selenium/standalone-chrome";
178 environment = {
179 VNC_NO_PASSWORD = "1";
180 SCREEN_WIDTH = "1920";
181 SCREEN_HEIGHT = "1080";
182 SCREEN_DEPTH = "24";
183 };
184 ports = [
185 "127.0.0.1:${toString cfg.chromePort}:4444"
186 ];
187 volumes = [
188 "/dev/shm:/dev/shm"
189 ];
190 extraOptions = [ "--network=bridge" ];
191 };
192 })
193
194 (mkIf cfg.playwrightSupport {
195 changedetection-io-playwright = {
196 image = "browserless/chrome";
197 environment = {
198 SCREEN_WIDTH = "1920";
199 SCREEN_HEIGHT = "1024";
200 SCREEN_DEPTH = "16";
201 ENABLE_DEBUGGER = "false";
202 PREBOOT_CHROME = "true";
203 CONNECTION_TIMEOUT = "300000";
204 MAX_CONCURRENT_SESSIONS = "10";
205 CHROME_REFRESH_TIME = "600000";
206 DEFAULT_BLOCK_ADS = "true";
207 DEFAULT_STEALTH = "true";
208 };
209 ports = [
210 "127.0.0.1:${toString cfg.chromePort}:3000"
211 ];
212 extraOptions = [ "--network=bridge" ];
213 };
214 })
215 ];
216 podman.defaultNetwork.dnsname.enable = true;
217 };
218 };
219}