101 lines
2.6 KiB
Nix
101 lines
2.6 KiB
Nix
{ pkgs, lib, ... }:
|
||
|
||
let
|
||
jmusicbot = pkgs.stdenv.mkDerivation {
|
||
pname = "jmusicbot";
|
||
version = "0.7.1";
|
||
|
||
src = pkgs.fetchurl {
|
||
url = "https://github.com/mutedvector/MusicBot/releases/download/v0.7.1/JMusicBot-0.7.1.jar";
|
||
hash = "sha256-NNM6WUKS1pfHfQ4DVbb6/hx0hSpH3W5RjFdawKLpr2c=";
|
||
};
|
||
|
||
dontUnpack = true;
|
||
|
||
nativeBuildInputs = [ pkgs.makeBinaryWrapper ];
|
||
|
||
installPhase = ''
|
||
runHook preInstall
|
||
|
||
mkdir -p $out/lib
|
||
cp $src $out/lib/JMusicBot-0.7.0.jar
|
||
|
||
makeBinaryWrapper ${pkgs.jdk25_headless}/bin/java $out/bin/jmusicbot \
|
||
--prefix PATH : ${lib.makeBinPath [ pkgs.jdk25_headless ]} \
|
||
--add-flags "-Dfile.encoding=UTF-8" \
|
||
--add-flags "-Dnogui=true" \
|
||
--add-flags "--enable-native-access=ALL-UNNAMED" \
|
||
--add-flags "-XX:+UseZGC" \
|
||
--add-flags "-XX:+AlwaysPreTouch" \
|
||
--add-flags "-jar $out/lib/JMusicBot-0.7.0.jar"
|
||
|
||
runHook postInstall
|
||
'';
|
||
|
||
meta = with lib; {
|
||
description = "A Discord music bot that's easy to set up (arif-banai fork)";
|
||
homepage = "https://github.com/arif-banai/MusicBot";
|
||
license = licenses.mit;
|
||
mainProgram = "jmusicbot";
|
||
};
|
||
};
|
||
in
|
||
{
|
||
environment.systemPackages = [ jmusicbot ];
|
||
|
||
users.users.jmusicbot = {
|
||
isSystemUser = true;
|
||
group = "jmusicbot";
|
||
home = "/var/lib/jmusicbot";
|
||
createHome = true;
|
||
description = "JMusicBot service user";
|
||
};
|
||
users.groups.jmusicbot = { };
|
||
|
||
systemd.services.jmusicbot = {
|
||
description = "JMusicBot – Discord music bot (arif-banai fork)";
|
||
after = [ "network-online.target" ];
|
||
wants = [ "network-online.target" ];
|
||
wantedBy = [ "multi-user.target" ];
|
||
|
||
serviceConfig = {
|
||
Type = "simple";
|
||
User = "jmusicbot";
|
||
Group = "jmusicbot";
|
||
WorkingDirectory = "/var/lib/jmusicbot";
|
||
|
||
ExecStart = "${jmusicbot}/bin/jmusicbot";
|
||
|
||
NoNewPrivileges = true;
|
||
ProtectSystem = "strict";
|
||
ProtectHome = true;
|
||
PrivateTmp = true;
|
||
PrivateDevices = true;
|
||
ProtectKernelTunables = true;
|
||
ProtectKernelModules = true;
|
||
ProtectControlGroups = true;
|
||
RestrictAddressFamilies = [
|
||
"AF_INET"
|
||
"AF_INET6"
|
||
"AF_UNIX"
|
||
];
|
||
RestrictNamespaces = true;
|
||
LockPersonality = true;
|
||
RestrictRealtime = true;
|
||
RestrictSUIDSGID = true;
|
||
RemoveIPC = true;
|
||
CapabilityBoundingSet = [ "" ];
|
||
SystemCallArchitectures = "native";
|
||
ReadWritePaths = [ "/var/lib/jmusicbot" ];
|
||
|
||
Restart = "on-failure";
|
||
RestartSec = 10;
|
||
StartLimitBurst = 5;
|
||
StartLimitIntervalSec = 60;
|
||
|
||
MemoryMax = "1G";
|
||
TasksMax = 512;
|
||
};
|
||
};
|
||
}
|