e11sync-backend systemd unit

modules/e11sync/default.nix

@@ -6,11 +6,57 @@ e11sync-backend: {
   options.e11sync = with lib.types; {
     enable = lib.mkEnableOption "Enable e11sync";
     secretKeyPath = lib.mkOption {type = path;};
+    migrateOnStart = lib.mkOption {
+      type = bool;
+      default = false;
+    };
+    backendPort = lib.mkOption {
+      type = int;
+      default = 8002;
+    };
   };
 
-  config = lib.mkIf config.e11sync.enable {
-    environment.systemPackages = [
-      e11sync-backend
-    ];
-  };
+  config = let
+    cfg = config.e11sync;
+    pkg-backend = e11sync-backend.override {
+      inherit (cfg) backendPort;
+      databasePath = "/var/lib/e11sync/db.sqlite3";
+    };
+  in
+    lib.mkIf cfg.enable {
+      environment.systemPackages = [
+        pkg-backend
+      ];
+
+      systemd.services = {
+        e11sync-backend = {
+          description = "e11sync backend";
+          environment = {
+            TZ = "UTC";
+            E11SYNC_SECRET_KEY_PATH = "/run/credentials/secret_key";
+          };
+          wantedBy = ["multi-user.target"];
+          serviceConfig =
+            {
+              Type = "notify";
+              NotifyAccess = "all";
+              Restart = "on-failure";
+              RuntimeDirectory = "e11sync";
+              StateDirectory = "e11sync";
+              WorkingDirectory = "/var/lib/e11sync";
+              LoadCredential = "secret_key:${cfg.secretKeyPath}";
+              ExecStart = "${pkg-backend}/bin/e11sync-backend";
+
+              DynamicUser = true;
+              NoNewPrivileges = true;
+              PrivateDevices = true;
+              ProtectKernelTunables = true;
+              ProtectControlGroups = true;
+            }
+            // lib.mkIf cfg.migrateOnStart {
+              ExecStartPre = "${pkg-backend}/bin/e11sync migrate";
+            };
+        };
+      };
+    };
 }