music-agregator/nix/metadata-agregator.nix

{
  config,
  lib,
  pkgs,
  ...
}:

let
  cfg = config.services.agregators;
  metaCfg = cfg.metadata-agregator;
  pgCfg = cfg.postgres;
  db = pgCfg.metadataDatabase;
  yaml = pkgs.formats.yaml { };

  dbPasswordPlaceholder = "@META_DB_PASSWORD@";

  configFile = yaml.generate "metadata-agregator.yaml" {
    server.port = metaCfg.port;
    database = {
      host = if pgCfg.host == "/run/postgresql" then "localhost" else pgCfg.host;
      port = pgCfg.port;
      name = db.name;
      user = db.user;
      password = dbPasswordPlaceholder;
      sslmode = "disable";
    };
    logging = {
      level = metaCfg.logging.level;
      format = metaCfg.logging.format;
    };
    metrics = {
      enabled = metaCfg.metrics.enable;
      port = metaCfg.metrics.port;
    };
  };
in
{
  options.services.agregators.metadata-agregator = {
    enable = lib.mkEnableOption "metadata-agregator music metadata gRPC service";

    package = lib.mkOption {
      type = lib.types.package;
      description = "The metadata-agregator package.";
    };

    port = lib.mkOption {
      type = lib.types.port;
      default = 50051;
      description = "gRPC listen port.";
    };

    logging = {
      level = lib.mkOption {
        type = lib.types.str;
        default = "info";
        description = "Log level.";
      };

      format = lib.mkOption {
        type = lib.types.enum [
          "json"
          "console"
        ];
        default = "json";
        description = "Log output format.";
      };
    };

    metrics = {
      enable = lib.mkOption {
        type = lib.types.bool;
        default = true;
        description = "Enable Prometheus metrics endpoint.";
      };

      port = lib.mkOption {
        type = lib.types.port;
        default = 9091;
        description = "Prometheus metrics HTTP port.";
      };
    };

    openFirewall = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = "Open the gRPC port in the firewall.";
    };
  };

  config = lib.mkIf (cfg.enable && metaCfg.enable) {
    systemd.services.metadata-agregator = {
      description = "metadata-agregator - Music metadata gRPC service";
      after = [
        "network.target"
        "agregators-schema-metadata.service"
      ];
      requires = [ "agregators-schema-metadata.service" ];
      wantedBy = [ "multi-user.target" ];

      preStart = ''
        cp --no-preserve=mode ${configFile} /run/metadata-agregator/config.yaml

        ${
          if db.passwordFile != null then
            ''
              ${pkgs.replace-secret}/bin/replace-secret \
                '${dbPasswordPlaceholder}' \
                '${db.passwordFile}' \
                /run/metadata-agregator/config.yaml
            ''
          else
            ''
              ${pkgs.gnused}/bin/sed -i "s/${dbPasswordPlaceholder}//" /run/metadata-agregator/config.yaml
            ''
        }
      '';

      serviceConfig = {
        Type = "simple";
        ExecStart = "${lib.getExe metaCfg.package} -config /run/metadata-agregator/config.yaml";
        User = cfg.user;
        Group = cfg.group;
        RuntimeDirectory = "metadata-agregator";
        RuntimeDirectoryMode = "0750";
        Restart = "on-failure";
        RestartSec = 5;

        ProtectSystem = "strict";
        PrivateTmp = true;
        NoNewPrivileges = true;
        ProtectHome = true;
        ProtectKernelTunables = true;
        ProtectKernelModules = true;
        ProtectControlGroups = true;
      };
    };

    networking.firewall.allowedTCPPorts = lib.mkIf metaCfg.openFirewall (
      [ metaCfg.port ] ++ lib.optional metaCfg.metrics.enable metaCfg.metrics.port
    );
  };
}