Update greatyamada services

hosts/greatyamada/services/invidious/default.nix

@@ -0,0 +1,10 @@
+{ ... }: {
+  imports = [ ./invidious.nix ./inv-sig-helper.nix ];
+  users = {
+    groups.invidious = { };
+    users.invidious = {
+      group = "invidious";
+      isSystemUser = true;
+    };
+  };
+}

hosts/greatyamada/services/invidious/inv-sig-helper.nix

@@ -0,0 +1,83 @@
+{ pkgs, ... }:
+let portDefinitions = import ../_port-definitions.nix;
+in {
+  environment.systemPackages = with pkgs; [ inv-sig-helper ];
+  systemd.services.inv-sig-helper = {
+    enable = true;
+    after = [ "syslog.target" "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      User = "invidious";
+      Group = "invidious";
+      ExecStart =
+        "${pkgs.inv-sig-helper}/bin/inv_sig_helper_rust --tcp 127.0.0.1:${
+          toString portDefinitions.inv-sig-helper
+        }";
+      Restart = "always";
+      RestartSec = "2s";
+      Type = "simple";
+      WorkingDirectory = "/tmp";
+      BindPaths = "/tmp";
+      CapabilityBoundingSet = [
+        "~CAP_SETUID CAP_SETGID CAP_SETPCAP"
+        "~CAP_SYS_ADMIN"
+        "~CAP_SYS_PTRACE"
+        "~CAP_CHOWN CAP_FSETID CAP_SETFCAP"
+        "~CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER"
+        "~CAP_NET_ADMIN"
+        "~CAP_SYS_MODULE"
+        "~CAP_SYS_RAWIO"
+        "~CAP_SYS_TIME"
+        "~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE"
+        "~CAP_KILL"
+        "~CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW"
+        "~CAP_SYSLOG"
+        "~CAP_SYS_NICE CAP_SYS_RESOURCE"
+        "~CAP_MAC_ADMIN CAP_MAC_OVERRIDE"
+        "~CAP_SYS_BOOT"
+        "~CAP_LINUX_IMMUTABLE"
+        "~CAP_IPC_LOCK"
+        "~CAP_SYS_CHROOT"
+        "~CAP_BLOCK_SUSPEND"
+        "~CAP_LEASE"
+        "~CAP_SYS_PACCT"
+        "~CAP_SYS_TTY_CONFIG"
+        "~CAP_WAKE_ALARM"
+      ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectControlGroups = true;
+      ProtectHome = "tmpfs";
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
+      RestrictNamespaces = true;
+      RestrictSUIDSGID = true;
+      RestrictRealtime = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "~@clock"
+        "~@debug"
+        "~@module"
+        "~@mount"
+        "~@raw-io"
+        "~@reboot"
+        "~@swap"
+        "~@privileged"
+        "~@resources"
+        "~@cpu-emulation"
+        "~@obsolete"
+      ];
+    };
+  };
+}

hosts/greatyamada/services/invidious/invidious.nix

@@ -0,0 +1,51 @@
+{ ... }:
+let
+  nginxLocalServiceConfig = import ./nginx-local-config.nix;
+  ports = import ../_port-definitions.nix;
+in {
+  services = {
+    invidious = {
+      enable = true;
+      port = ports.invidious-http;
+      extraSettingsFile = "/var/lib/invidious/extra_configuration";
+      settings = {
+        check_tables = true;
+        db.user = "invidious";
+        default_user_preferences = {
+          locale = "es";
+          dark_mode = "dark";
+          autoplay = true;
+          video_loop = true;
+          quality = "dash";
+          volume = 20;
+        };
+        signature_server = "localhost:${toString ports.inv-sig-helper}";
+      };
+      database = {
+        createLocally = false;
+        passwordFile = "/var/lib/invidious/db_password";
+      };
+      hmacKeyFile = "/var/lib/invidious/hmac_key";
+    };
+    nginx.virtualHosts."iv.rcia.dev" = {
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString ports.invidious-http}";
+      };
+      extraConfig = nginxLocalServiceConfig;
+    };
+  };
+  sops.secrets = {
+    "invidious/db_password" = {
+      path = "/var/lib/invidious/db_password";
+      owner = "invidious";
+    };
+    "invidious/hmac" = {
+      path = "/var/lib/invidious/hmac_key";
+      owner = "invidious";
+    };
+    "invidious/extra_secrets" = {
+      path = "/var/lib/invidious/extra_configuration";
+      owner = "invidious";
+    };
+  };
+}