consolidated options

2026-07-01 00:19:17 -05:00
parent 43fe37d4e2
commit b13b774738
2 changed files with 69 additions and 16 deletions
@@ -1,12 +1,67 @@
 { self, inputs, ... }: {
-  flake.modules.nixos.restic-server = { config, pkgs, lib, ... }: {
-    services.restic.server = {
-      enable = true;
-      dataDir = "/mnt/restic";
-      listenAddress = "0.0.0.0:8080";
-      extraFlags = [ "--no-auth" ];
+  flake.modules.nixos.restic-server = { config, pkgs, lib, ... }:
+    let
+      cfg = config.resticServer;
+      port = builtins.fromJSON (lib.last (lib.splitString ":" cfg.listenAddress));
+    in {
+      options.resticServer = {
+        enable = lib.mkEnableOption "Enable the RESTic REST server";
+
+        dataDir = lib.mkOption {
+          description = "Storage directory for RESTic repositories served by this host.";
+          type = lib.types.str;
+          default = "/mnt/restic";
+        };
+
+        listenAddress = lib.mkOption {
+          description = "Listen address for the RESTic REST server.";
+          type = lib.types.str;
+          default = "0.0.0.0:8080";
+        };
+
+        privateRepos = lib.mkOption {
+          description = "Whether the RESTic server should use private repository mode.";
+          type = lib.types.bool;
+          default = true;
+        };
+
+        extraFlags = lib.mkOption {
+          description = "Additional flags to pass to the RESTic REST server before TLS flags are appended.";
+          type = lib.types.listOf lib.types.str;
+          default = [ "--no-auth" ];
+        };
+
+        tls = {
+          certFile = lib.mkOption {
+            description = "Path to the TLS certificate file for the RESTic REST server, or null to disable TLS.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+
+          keyFile = lib.mkOption {
+            description = "Path to the TLS private key file for the RESTic REST server, or null to disable TLS.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        networking.firewall.allowedTCPPorts = [ port ];
+
+        services.restic.server = {
+          enable = true;
+          inherit (cfg) dataDir listenAddress privateRepos;
+          extraFlags =
+            cfg.extraFlags
+            ++ lib.optionals (cfg.tls.certFile != null && cfg.tls.keyFile != null) [
+              "--tls"
+              "--tls-cert=${cfg.tls.certFile}"
+              "--tls-key=${cfg.tls.keyFile}"
+            ];
+        };
+      };
    };
-  };

  flake.modules.homeManager.restic = { config, pkgs, lib, ... }:
    let