Adds CNSPRCY service

projects/CNSPRCY/default.nix

@@ -3,20 +3,38 @@
   pkgs,
   sources,
 }@args:
+
 {
   metadata = {
+    summary = "E2EE connections between trusted devices for establishing private group chats.";
     subgrants = [
       "CNSPRCY"
     ];
+    links = {
+      source = {
+        text = "CNSPRCY source code";
+        url = "https://git.sr.ht/~xaos/cnsprcy";
+      };
+    };
   };
 
-  # https://git.sr.ht/~xaos/cnsprcy/tree/master/item/src/config.rs
   nixos.modules.programs.cnsprcy = {
-    module = ./module.nix;
-    examples.cnsprcy = {
-      module = ./example.nix;
-      description = "";
-      tests.basic = import ./test.nix args;
+    name = "cnsprcy";
+    module = ./programs/cnsprcy/module.nix;
+    examples.basic = {
+      module = ./programs/cnsprcy/examples/basic.nix;
+      description = "Checks for cnspr executable";
+      tests.basic = import ./programs/cnsprcy/tests/basic.nix args;
+    };
+  };
+
+  nixos.modules.services.cnsprcy = {
+    name = "cnsprcy";
+    module = ./services/cnsprcy/module.nix;
+    examples.basic = {
+      module = ./services/cnsprcy/examples/basic.nix;
+      description = "Checks that cnsprcy systemd service is running";
+      tests.basic = import ./services/cnsprcy/tests/basic.nix args;
     };
   };
 }

projects/CNSPRCY/example.nix → projects/CNSPRCY/programs/cnsprcy/examples/basic.nix

@@ -1,4 +1,5 @@
 { ... }:
+
 {
   programs.cnsprcy.enable = true;
 }

projects/CNSPRCY/module.nix → projects/CNSPRCY/programs/cnsprcy/module.nix

@@ -1,7 +1,7 @@
 {
+  config,
   lib,
   pkgs,
-  config,
   ...
 }:
 let

projects/CNSPRCY/test.nix → projects/CNSPRCY/programs/cnsprcy/tests/basic.nix

@@ -2,6 +2,7 @@
   sources,
   ...
 }:
+
 {
   name = "cnsprcy";
 
@@ -12,7 +13,7 @@
         imports = [
           sources.modules.ngipkgs
           sources.modules.programs.cnsprcy
-          sources.examples.CNSPRCY.cnsprcy
+          sources.examples.CNSPRCY.basic
         ];
       };
   };

projects/CNSPRCY/services/cnsprcy/examples/basic.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  services.cnsprcy.enable = true;
+}

projects/CNSPRCY/services/cnsprcy/module.nix

@@ -0,0 +1,86 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.cnsprcy;
+in
+{
+  options.services.cnsprcy = {
+    enable = lib.mkEnableOption "cnsprcy";
+    package = lib.mkPackageOption pkgs "cnsprcy" { };
+
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      description = "Hostname of CNSPRCY server";
+      default = config.networking.hostName;
+    };
+
+    stateDir = lib.mkOption {
+      type = lib.types.str;
+      description = "State directory for CNSPRCY server";
+      default = "/var/lib/cnsprcy";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      description = "Username of the system user that should own files and services related to CNSPRCY.";
+      default = "cnsprcy";
+    };
+    group = lib.mkOption {
+      type = lib.types.str;
+      description = "Group that contains the system user that executes CNSPRCY.";
+      default = "cnsprcy";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    environment.systemPackages = [ cfg.package ];
+
+    users.users."${cfg.user}" = {
+      isSystemUser = true;
+      group = cfg.group;
+
+      # CNSPRCY looks for the user home to initialize its data directory
+      # at $stateDir/.local/share/cnsprcy, but systemd.tmpfiles needs to create
+      # the dir otherwise permissions won't be set correctly.
+      home = cfg.stateDir;
+      useDefaultShell = true;
+    };
+    users.groups."${cfg.group}" = { };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.stateDir}/.local/share/cnsprcy 0700 ${cfg.user} ${cfg.group} -"
+      "d ${cfg.stateDir}/.local/share/cnsprcy/handlers 0700 ${cfg.user} ${cfg.group} -"
+    ];
+
+    systemd.services.cnsprcy = {
+      description = "CNSPRCY service";
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "nss-user-lookup.target"
+        "systemd-tmpfiles-setup.service"
+      ];
+
+      # Runs interactive config initialization to set machine name, generate
+      # conspirator keys and initial CNSPRCY db. TODO use the config init flags
+      # instead, but will need to investigate how to feed args to `cnspr serve`.
+      #
+      # That said we'll ultimately want to generate the config using options rather
+      # than dynamically like this.
+      # See https://github.com/ngi-nix/ngipkgs/pull/870#discussion_r2077898766
+      preStart = "printf 'n\n${cfg.hostname}\ny\n' | ${lib.getExe cfg.package} config init";
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} serve";
+        Restart = "on-failure";
+        User = cfg.user;
+        Group = cfg.group;
+      };
+    };
+
+  };
+}

projects/CNSPRCY/services/cnsprcy/tests/basic.nix

@@ -0,0 +1,46 @@
+{
+  sources,
+  ...
+}:
+{
+  name = "cnsprcy-server";
+
+  nodes = {
+    machine1 =
+      { ... }:
+      {
+        imports = [
+          sources.modules.ngipkgs
+          sources.modules.services.cnsprcy
+          sources.examples.CNSPRCY.basic
+        ];
+        networking.firewall.enable = false;
+      };
+    machine2 =
+      { ... }:
+      {
+        imports = [
+          sources.modules.ngipkgs
+          sources.modules.services.cnsprcy
+          sources.examples.CNSPRCY.basic
+        ];
+        networking.firewall.enable = false;
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      machine1.wait_for_unit("cnsprcy.service")
+      machine2.wait_for_unit("cnsprcy.service")
+
+      machine1.succeed("su cnsprcy -c 'cnspr interface add 192.168.1.1:3030'")
+      machine2.succeed("su cnsprcy -c 'cnspr interface add 192.168.1.2:3030'")
+
+      pubkey = machine1.succeed("su cnsprcy -c 'cnspr manage advertise'").split()[-1]
+      invitation = machine2.succeed("su cnsprcy -c 'cnspr manage invite {}'".format(pubkey)).split()[-1]
+      machine1.succeed("su cnsprcy -c 'cnspr manage accept {}'".format(invitation))
+    '';
+}