features: add jmusicbot feature

features/jmusicbot.nix

@@ -0,0 +1,100 @@
+{ pkgs, lib, ... }:
+
+let
+  jmusicbot = pkgs.stdenv.mkDerivation {
+    pname = "jmusicbot";
+    version = "0.7.1";
+
+    src = pkgs.fetchurl {
+      url = "https://github.com/mutedvector/MusicBot/releases/download/v0.7.1/JMusicBot-0.7.1.jar";
+      hash = "sha256-NNM6WUKS1pfHfQ4DVbb6/hx0hSpH3W5RjFdawKLpr2c=";
+    };
+
+    dontUnpack = true;
+
+    nativeBuildInputs = [ pkgs.makeBinaryWrapper ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/lib
+      cp $src $out/lib/JMusicBot-0.7.0.jar
+
+      makeBinaryWrapper ${pkgs.jdk25_headless}/bin/java $out/bin/jmusicbot \
+        --prefix PATH : ${lib.makeBinPath [ pkgs.jdk25_headless ]} \
+        --add-flags "-Dfile.encoding=UTF-8" \
+        --add-flags "-Dnogui=true" \
+        --add-flags "--enable-native-access=ALL-UNNAMED" \
+        --add-flags "-XX:+UseZGC" \
+        --add-flags "-XX:+AlwaysPreTouch" \
+        --add-flags "-jar $out/lib/JMusicBot-0.7.0.jar"
+
+      runHook postInstall
+    '';
+
+    meta = with lib; {
+      description = "A Discord music bot that's easy to set up (arif-banai fork)";
+      homepage = "https://github.com/arif-banai/MusicBot";
+      license = licenses.mit;
+      mainProgram = "jmusicbot";
+    };
+  };
+in
+{
+  environment.systemPackages = [ jmusicbot ];
+
+  users.users.jmusicbot = {
+    isSystemUser = true;
+    group = "jmusicbot";
+    home = "/var/lib/jmusicbot";
+    createHome = true;
+    description = "JMusicBot service user";
+  };
+  users.groups.jmusicbot = { };
+
+  systemd.services.jmusicbot = {
+    description = "JMusicBot – Discord music bot (arif-banai fork)";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "jmusicbot";
+      Group = "jmusicbot";
+      WorkingDirectory = "/var/lib/jmusicbot";
+
+      ExecStart = "${jmusicbot}/bin/jmusicbot";
+
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      PrivateDevices = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      LockPersonality = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      RemoveIPC = true;
+      CapabilityBoundingSet = [ "" ];
+      SystemCallArchitectures = "native";
+      ReadWritePaths = [ "/var/lib/jmusicbot" ];
+
+      Restart = "on-failure";
+      RestartSec = 10;
+      StartLimitBurst = 5;
+      StartLimitIntervalSec = 60;
+
+      MemoryMax = "1G";
+      TasksMax = 512;
+    };
+  };
+}

hosts/vergil/configuration.nix

@@ -9,6 +9,7 @@ in
 {
   imports = [
     ../shared/nixos-server.nix
+    ../../features/jmusicbot.nix
   ];
 
   systemd.services.mount-vm-disk = {