proof of concept qotd server

nix/module.nix

@@ -0,0 +1,86 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.qotd;
+in
+{
+  options.services.qotd = {
+    enable = lib.mkEnableOption "Enable qotd";
+
+    package = lib.mkPackageOption pkgs "qotd" { };
+
+    quotes = lib.mkOption {
+      description = "";
+      type = lib.types.listOf lib.types.str;
+      default = [];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services."qotd@" = {
+      description = "qotd";
+      environment.QOTD_QUOTES_PATH = lib.pipe cfg.quotes [
+        # (map (x: x + "\n"))
+        (lib.concatStringsSep "\n\n---\n\n")
+        (pkgs.writeText "qotd-db.txt")
+      ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${lib.getExe pkgs.uiua} run ${cfg.package}/bin/.main.uasm";
+
+        User = "qotd";
+        DynamicUser = true;
+
+        PrivateUsers = true;
+        PrivateNetwork = false;
+
+        StandardOutput = "socket";
+
+        # IPAddressDeny =
+        #   lib.optionals (lib.elem cfg.settings.mysql.host [ null "localhost" "127.0.0.1" ]) [ "any" ];
+
+        # RestrictAddressFamilies = [ "AF_UNIX" ]
+        #   ++ (lib.optionals (cfg.settings.mysql.host != null) [ "AF_INET" "AF_INET6" ]);
+
+        # AmbientCapabilities = [ "" ];
+        # CapabilityBoundingSet = [ "" ];
+        # DeviceAllow = [ "" ];
+        # LockPersonality = true;
+        # MemoryDenyWriteExecute = true;
+        # NoNewPrivileges = true;
+        # PrivateDevices = true;
+        # PrivateMounts = true;
+        # PrivateTmp = "yes";
+        # ProcSubset = "pid";
+        # ProtectClock = true;
+        # ProtectControlGroups = true;
+        # ProtectHome = true;
+        # ProtectHostname = true;
+        # ProtectKernelLogs = true;
+        # ProtectKernelModules = true;
+        # ProtectKernelTunables = true;
+        # ProtectProc = "invisible";
+        # ProtectSystem = "strict";
+        # RemoveIPC = true;
+        # UMask = "0777";
+        # RestrictNamespaces = true;
+        # RestrictRealtime = true;
+        # RestrictSUIDSGID = true;
+        # SystemCallArchitectures = "native";
+        # SocketBindDeny = [ "any" ];
+        # SystemCallFilter = [
+        #   "@system-service"
+        #   "~@privileged"
+        #   "~@resources"
+        # ];
+      };
+    };
+
+    systemd.sockets."qotd" = {
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = 17;
+        Accept = "yes";
+      };
+    };
+  };
+}