nixpkgs/nixos/modules/services/misc/parsoid.nix

{ config, lib, pkgs, ... }:
let

  cfg = config.services.parsoid;

  parsoid = pkgs.nodePackages.parsoid;

  confTree = {
    worker_heartbeat_timeout = 300000;
    logging = { level = "info"; };
    services = [{
      module = "lib/index.js";
      entrypoint = "apiServiceWorker";
      conf = {
        mwApis = map (x: if lib.isAttrs x then x else { uri = x; }) cfg.wikis;
        serverInterface = cfg.interface;
        serverPort = cfg.port;
      };
    }];
  };

  confFile = pkgs.writeText "config.yml" (builtins.toJSON (lib.recursiveUpdate confTree cfg.extraConfig));

in
{
  imports = [
    (lib.mkRemovedOptionModule [ "services" "parsoid" "interwikis" ] "Use services.parsoid.wikis instead")
  ];

  ##### interface

  options = {

    services.parsoid = {

      enable = lib.mkOption {
        type = lib.types.bool;
        default = false;
        description = ''
          Whether to enable Parsoid -- bidirectional
          wikitext parser.
        '';
      };

      wikis = lib.mkOption {
        type = lib.types.listOf (lib.types.either lib.types.str lib.types.attrs);
        example = [ "http://localhost/api.php" ];
        description = ''
          Used MediaWiki API endpoints.
        '';
      };

      workers = lib.mkOption {
        type = lib.types.int;
        default = 2;
        description = ''
          Number of Parsoid workers.
        '';
      };

      interface = lib.mkOption {
        type = lib.types.str;
        default = "127.0.0.1";
        description = ''
          Interface to listen on.
        '';
      };

      port = lib.mkOption {
        type = lib.types.port;
        default = 8000;
        description = ''
          Port to listen on.
        '';
      };

      extraConfig = lib.mkOption {
        type = lib.types.attrs;
        default = {};
        description = ''
          Extra configuration to add to parsoid configuration.
        '';
      };

    };

  };

  ##### implementation

  config = lib.mkIf cfg.enable {

    systemd.services.parsoid = {
      description = "Bidirectional wikitext parser";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      serviceConfig = {
        ExecStart = "${parsoid}/lib/node_modules/parsoid/bin/server.js -c ${confFile} -n ${toString cfg.workers}";

        DynamicUser = true;
        User = "parsoid";
        Group = "parsoid";

        CapabilityBoundingSet = "";
        NoNewPrivileges = true;
        ProtectSystem = "strict";
        ProtectHome = true;
        PrivateTmp = true;
        PrivateDevices = true;
        ProtectHostname = true;
        ProtectKernelTunables = true;
        ProtectKernelModules = true;
        ProtectControlGroups = true;
        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
        RestrictNamespaces = true;
        LockPersonality = true;
        #MemoryDenyWriteExecute = true;
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
        RemoveIPC = true;
      };
    };

  };

}