proof of concept qotd server

nix/module.nix

@@ -0,0 +1,86 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.qotd;
+in
+{
+  options.services.qotd = {
+    enable = lib.mkEnableOption "Enable qotd";
+
+    package = lib.mkPackageOption pkgs "qotd" { };
+
+    quotes = lib.mkOption {
+      description = "";
+      type = lib.types.listOf lib.types.str;
+      default = [];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services."qotd@" = {
+      description = "qotd";
+      environment.QOTD_QUOTES_PATH = lib.pipe cfg.quotes [
+        # (map (x: x + "\n"))
+        (lib.concatStringsSep "\n\n---\n\n")
+        (pkgs.writeText "qotd-db.txt")
+      ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${lib.getExe pkgs.uiua} run ${cfg.package}/bin/.main.uasm";
+
+        User = "qotd";
+        DynamicUser = true;
+
+        PrivateUsers = true;
+        PrivateNetwork = false;
+
+        StandardOutput = "socket";
+
+        # IPAddressDeny =
+        #   lib.optionals (lib.elem cfg.settings.mysql.host [ null "localhost" "127.0.0.1" ]) [ "any" ];
+
+        # RestrictAddressFamilies = [ "AF_UNIX" ]
+        #   ++ (lib.optionals (cfg.settings.mysql.host != null) [ "AF_INET" "AF_INET6" ]);
+
+        # AmbientCapabilities = [ "" ];
+        # CapabilityBoundingSet = [ "" ];
+        # DeviceAllow = [ "" ];
+        # LockPersonality = true;
+        # MemoryDenyWriteExecute = true;
+        # NoNewPrivileges = true;
+        # PrivateDevices = true;
+        # PrivateMounts = true;
+        # PrivateTmp = "yes";
+        # ProcSubset = "pid";
+        # ProtectClock = true;
+        # ProtectControlGroups = true;
+        # ProtectHome = true;
+        # ProtectHostname = true;
+        # ProtectKernelLogs = true;
+        # ProtectKernelModules = true;
+        # ProtectKernelTunables = true;
+        # ProtectProc = "invisible";
+        # ProtectSystem = "strict";
+        # RemoveIPC = true;
+        # UMask = "0777";
+        # RestrictNamespaces = true;
+        # RestrictRealtime = true;
+        # RestrictSUIDSGID = true;
+        # SystemCallArchitectures = "native";
+        # SocketBindDeny = [ "any" ];
+        # SystemCallFilter = [
+        #   "@system-service"
+        #   "~@privileged"
+        #   "~@resources"
+        # ];
+      };
+    };
+
+    systemd.sockets."qotd" = {
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = 17;
+        Accept = "yes";
+      };
+    };
+  };
+}

nix/package.nix

@@ -0,0 +1,54 @@
+{
+  lib
+, uiua
+, stdenvNoCC
+, runtimeShell
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "qotd";
+  version = "unstable";
+
+  src = builtins.filterSource (path: type: let
+    baseName = baseNameOf (toString path);
+  in !(lib.any (b: b) [
+      (!(lib.cleanSourceFilter path type))
+      (type == "directory" && lib.elem baseName [
+        ".direnv"
+        ".git"
+        ".jj"
+        "target"
+        "result"
+      ])
+      (type == "regular" && lib.elem baseName [
+        "flake.nix"
+        "flake.lock"
+        "default.nix"
+        "module.nix"
+        ".envrc"
+      ])
+      (type == "regular" && lib.hasSuffix ".uasm" baseName)
+    ])) ./..;
+
+  nativeBuildInputs = [ uiua ];
+
+  buildPhase = ''
+      runHook preBuild
+      uiua build --output .main.uasm main.ua
+      runHook postBuild
+  '';
+
+  wrapper = ''
+      #!${runtimeShell}
+      "${uiua}"/bin/uiua run ${placeholder "out"}/bin/.main.uasm
+  '';
+
+  passAsFile = [ "wrapper" ];
+
+  installPhase = ''
+      runHook preInstall
+      install -Dm444 .main.uasm -t "$out"/bin
+      install -Dm555 "$wrapperPath" "$out"/bin/qotd
+      runHook postInstall
+  '';
+}