pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6 cfg = config.services.dragonflydb;
7 dragonflydb = pkgs.dragonflydb;
8
9 settings =
10 {
11 port = cfg.port;
12 dir = "/var/lib/dragonflydb";
13 keys_output_limit = cfg.keysOutputLimit;
14 } //
15 (lib.optionalAttrs (cfg.bind != null) { bind = cfg.bind; }) //
16 (lib.optionalAttrs (cfg.requirePass != null) { requirepass = cfg.requirePass; }) //
17 (lib.optionalAttrs (cfg.maxMemory != null) { maxmemory = cfg.maxMemory; }) //
18 (lib.optionalAttrs (cfg.memcachePort != null) { memcache_port = cfg.memcachePort; }) //
19 (lib.optionalAttrs (cfg.dbNum != null) { dbnum = cfg.dbNum; }) //
20 (lib.optionalAttrs (cfg.cacheMode != null) { cache_mode = cfg.cacheMode; });
21in
22{
23
24 ###### interface
25
26 options = {
27 services.dragonflydb = {
28 enable = mkEnableOption (lib.mdDoc "DragonflyDB");
29
30 user = mkOption {
31 type = types.str;
32 default = "dragonfly";
33 description = lib.mdDoc "The user to run DragonflyDB as";
34 };
35
36 port = mkOption {
37 type = types.port;
38 default = 6379;
39 description = lib.mdDoc "The TCP port to accept connections.";
40 };
41
42 bind = mkOption {
43 type = with types; nullOr str;
44 default = "127.0.0.1";
45 description = lib.mdDoc ''
46 The IP interface to bind to.
47 `null` means "all interfaces".
48 '';
49 };
50
51 requirePass = mkOption {
52 type = with types; nullOr str;
53 default = null;
54 description = lib.mdDoc "Password for database";
55 example = "letmein!";
56 };
57
58 maxMemory = mkOption {
59 type = with types; nullOr ints.unsigned;
60 default = null;
61 description = lib.mdDoc ''
62 The maximum amount of memory to use for storage (in bytes).
63 `null` means this will be automatically set.
64 '';
65 };
66
67 memcachePort = mkOption {
68 type = with types; nullOr port;
69 default = null;
70 description = lib.mdDoc ''
71 To enable memcached compatible API on this port.
72 `null` means disabled.
73 '';
74 };
75
76 keysOutputLimit = mkOption {
77 type = types.ints.unsigned;
78 default = 8192;
79 description = lib.mdDoc ''
80 Maximum number of returned keys in keys command.
81 `keys` is a dangerous command.
82 We truncate its result to avoid blowup in memory when fetching too many keys.
83 '';
84 };
85
86 dbNum = mkOption {
87 type = with types; nullOr ints.unsigned;
88 default = null;
89 description = lib.mdDoc "Maximum number of supported databases for `select`";
90 };
91
92 cacheMode = mkOption {
93 type = with types; nullOr bool;
94 default = null;
95 description = lib.mdDoc ''
96 Once this mode is on, Dragonfly will evict items least likely to be stumbled
97 upon in the future but only when it is near maxmemory limit.
98 '';
99 };
100 };
101 };
102
103 ###### implementation
104
105 config = mkIf config.services.dragonflydb.enable {
106
107 users.users = optionalAttrs (cfg.user == "dragonfly") {
108 dragonfly.description = "DragonflyDB server user";
109 dragonfly.isSystemUser = true;
110 dragonfly.group = "dragonfly";
111 };
112 users.groups = optionalAttrs (cfg.user == "dragonfly") { dragonfly = { }; };
113
114 environment.systemPackages = [ dragonflydb ];
115
116 systemd.services.dragonflydb = {
117 description = "DragonflyDB server";
118
119 wantedBy = [ "multi-user.target" ];
120 after = [ "network.target" ];
121
122 serviceConfig = {
123 ExecStart = "${dragonflydb}/bin/dragonfly --alsologtostderr ${builtins.concatStringsSep " " (attrsets.mapAttrsToList (n: v: "--${n} ${strings.escapeShellArg v}") settings)}";
124
125 User = cfg.user;
126
127 # Filesystem access
128 ReadWritePaths = [ settings.dir ];
129 StateDirectory = "dragonflydb";
130 StateDirectoryMode = "0700";
131 # Process Properties
132 LimitMEMLOCK = "infinity";
133 # Caps
134 CapabilityBoundingSet = "";
135 NoNewPrivileges = true;
136 # Sandboxing
137 ProtectSystem = "strict";
138 ProtectHome = true;
139 PrivateTmp = true;
140 PrivateDevices = true;
141 ProtectKernelTunables = true;
142 ProtectKernelModules = true;
143 ProtectControlGroups = true;
144 LockPersonality = true;
145 RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
146 RestrictRealtime = true;
147 PrivateMounts = true;
148 MemoryDenyWriteExecute = true;
149 };
150 };
151 };
152}