feat: fde-lock endpoint for home assistant, init_on_free

fde-lock.nix

@@ -0,0 +1,80 @@
+{ config, pkgs, ... }:
+
+# Home Assistant endpoint that puts Nethergarde (truenas VM) and ashenvale_crypt to rest.
+# HTTP API (unprivileged) -> trigger file in /run/fde-lock-api -> path unit -> root oneshot.
+# Token: /etc/nixos/secrets/fde-lock-token (not versioned).
+
+let
+  listen = "192.168.0.19";
+  port = 8742;
+  allowed = "192.168.0.14"; # varian (Home Assistant)
+
+  fde-lock = pkgs.writeShellApplication {
+    name = "fde-lock";
+    runtimeInputs = with pkgs; [
+      coreutils util-linux procps gawk gnused
+      lvm2 cryptsetup
+      config.virtualisation.incus.clientPackage
+    ];
+    text = builtins.readFile ./fde-lock/lock.sh;
+  };
+
+  lockService = mode: {
+    description = "Put Nethergarde and ashenvale_crypt to rest (${mode})";
+    # Never (re)started by a rebuild, only by its path unit.
+    restartIfChanged = false;
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${fde-lock}/bin/fde-lock ${mode}";
+      StandardInput = "null";
+      TimeoutStartSec = "6min";
+    };
+  };
+
+  trigger = name: {
+    wantedBy = [ "paths.target" ];
+    pathConfig = {
+      PathChanged = "/run/fde-lock-api/${name}";
+      Unit = "fde-${name}.service";
+    };
+  };
+in
+{
+  systemd.services.fde-lock = lockService "lock";
+  systemd.services.fde-check = lockService "check";
+  systemd.paths.fde-lock = trigger "lock";
+  systemd.paths.fde-check = trigger "check";
+
+  users.users.fde-lock-api = { isSystemUser = true; group = "fde-lock-api"; };
+  users.groups.fde-lock-api = { };
+
+  systemd.tmpfiles.rules = [
+    "d /run/fde-lock-api 0755 fde-lock-api fde-lock-api -"
+    "d /run/fde-lock 0755 root root -"
+  ];
+
+  systemd.services.fde-lock-api = {
+    description = "HTTP trigger for fde-lock (Home Assistant)";
+    wantedBy = [ "multi-user.target" ];
+    wants = [ "network-online.target" ];
+    after = [ "network-online.target" ];
+    environment = {
+      FDE_LOCK_LISTEN = listen;
+      FDE_LOCK_PORT = toString port;
+      FDE_LOCK_ALLOWED = allowed;
+    };
+    serviceConfig = {
+      ExecStart = "${pkgs.python3}/bin/python3 ${./fde-lock/api.py}";
+      User = "fde-lock-api";
+      Group = "fde-lock-api";
+      LoadCredential = "token:/etc/nixos/secrets/fde-lock-token";
+      Restart = "always";
+      RestartSec = 5;
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      ReadWritePaths = [ "/run/fde-lock-api" ];
+    };
+  };
+}