pkgs/jellysearch: init at 0.0.1

hosts/library/jellysearch.nix

@@ -16,21 +16,43 @@
     masterKeyEnvironmentFile = config.age.secrets."files/services/meilisearch/envfile".path;
   };
 
-  virtualisation.oci-containers.containers = {
-    jellysearch = {
-      image = "domistyle/jellysearch";
-      environment = {
-        INDEX_CRON = "0 0 0/2 ? * * *";
-        JELLYFIN_URL = "http://localhost:8096";
-        MEILI_URL = "http://localhost:${toString config.services.meilisearch.listenPort}";
-      };
-      environmentFiles = [
-        config.age.secrets."files/services/meilisearch/envfile".path
-      ];
-      volumes = [
-        "${toString config.services.jellyfin.configDir}:/config:ro"
-      ];
-      extraOptions = [ "--network=host" ];
+  users.users.jellysearch = {
+    group = "jellysearch";
+    isSystemUser = true;
+  };
+
+  users.groups.jellysearch = { };
+
+  systemd.services.jellysearch = {
+    enable = true;
+    description = "JellySearch";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Restart = "on-failure";
+      ExecStart = "${pkgs.jellysearch}/bin/jellysearch";
+      StateDirectory = "jellysearch";
+      StateDirectoryMode = "0750";
+      WorkingDirectory = "/var/lib/jellysearch";
+      EnivronmentFile = config.age.secrets."files/services/meilisearch/envfile".path;
+
+      NoNewPrivileges = true;
+      SystemCallArchitectures = "native";
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      ProtectHostname = true;
+      LockPersonality = true;
+      PrivateDevices = true;
+      PrivateUsers = true;
+      RemoveIPC = true;
+    };
+    environment = {
+      DOTNET_ENVIRONMENT = "Production";
+      INDEX_CRON = "0 0 0/2 ? * * *";
+      JELLYFIN_URL = "http://localhost:8096";
+      JELLYFIN_CONFIG_DIR = "${toString config.services.jellyfin.configDir}";
+      MEILI_URL = "http://localhost:${toString config.services.meilisearch.listenPort}";
     };
   };
 }