Move modules in programs/services subfolders

modules/system/services/hedgedoc/backups.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  user = config.users.users.hedgedoc.name;
+in
+{
+  options.custom.services.hedgedoc.backups.enable = lib.mkEnableOption "";
+
+  config = lib.mkIf config.custom.services.hedgedoc.backups.enable {
+    security.polkit = {
+      enable = true;
+      extraConfig =
+        let
+          service = "hedgedoc.service";
+        in
+        ''
+          polkit.addRule(function(action, subject) {
+            if (action.id == "org.freedesktop.systemd1.manage-units" &&
+              action.lookup("unit") == "${service}" &&
+              subject.user == "${user}") {
+              return polkit.Result.YES;
+            }
+          });
+        '';
+    };
+
+    custom.services.resticBackup.hedgedoc = {
+      inherit user;
+      healthchecks.enable = true;
+
+      extraConfig = {
+        backupPrepareCommand = "${lib.getExe' pkgs.systemd "systemctl"} stop hedgedoc.service";
+        backupCleanupCommand = "${lib.getExe' pkgs.systemd "systemctl"} start hedgedoc.service";
+        paths = with config.services.hedgedoc.settings; [
+          uploadsPath
+          db.storage
+        ];
+      };
+    };
+
+    environment.systemPackages = [
+      (pkgs.writeShellApplication {
+        name = "hedgedoc-restore";
+        text = ''
+          sudo --user=${user} bash -c "
+            systemctl stop hedgedoc.service
+            restic-hedgedoc restore latest --target /
+            systemctl start hedgedoc.service
+          "
+        '';
+      })
+    ];
+  };
+}

modules/system/services/hedgedoc/default.nix

@@ -0,0 +1,82 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.custom.services.hedgedoc;
+
+  user = config.users.users.hedgedoc.name;
+
+  manage_users = "CMD_CONFIG_FILE=/run/hedgedoc/config.json NODE_ENV=production ${lib.getExe' pkgs.hedgedoc "manage_users"}";
+in
+{
+  options.custom.services.hedgedoc = {
+    enable = lib.mkEnableOption "";
+    subdomain = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      default = "";
+    };
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 3000;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    sops = {
+      secrets = {
+        "hedgedoc/seb-password".owner = user;
+        "hedgedoc/gitlab-auth-secret".owner = user;
+      };
+
+      templates."hedgedoc/environment" = {
+        owner = user;
+        content = "GITLAB_CLIENTSECRET=${config.sops.placeholder."hedgedoc/gitlab-auth-secret"}";
+      };
+    };
+
+    services.hedgedoc = {
+      enable = true;
+
+      environmentFile = config.sops.templates."hedgedoc/environment".path;
+      settings = {
+        domain = "${cfg.subdomain}.${config.networking.domain}";
+        inherit (cfg) port;
+        protocolUseSSL = true;
+        allowAnonymous = false;
+        allowEmailRegister = false;
+        defaultPermission = "limited";
+        sessionSecret = "$SESSION_SECRET";
+        gitlab = {
+          baseURL = "https://code.fbi.h-da.de";
+          clientID = "dc71d7ec1525ce3b425d7d41d602f67e1a06cef981259605a87841a6be62cc58";
+          clientSecret = "$GITLAB_CLIENTSECRET";
+        };
+      };
+    };
+
+    systemd.services.hedgedoc = {
+      # Ensure session-secret
+      preStart = lib.mkBefore ''
+        if [ ! -f /var/lib/hedgedoc/session-secret ]; then
+          ${lib.getExe pkgs.pwgen} -s 64 1 > /var/lib/hedgedoc/session-secret
+        fi
+        export SESSION_SECRET=$(cat /var/lib/hedgedoc/session-secret)
+      '';
+
+      postStart =
+        let
+          manageUserSeb =
+            mode:
+            "${manage_users} --${mode} sebastian.stork@pm.me --pass \"$(cat ${
+              config.sops.secrets."hedgedoc/seb-password".path
+            })\"";
+        in
+        "${manageUserSeb "add"} || ${manageUserSeb "reset"}";
+    };
+
+    environment.shellAliases.hedgedoc-manage-users = "sudo --user=${user} ${manage_users}";
+  };
+}