move ocserv to SP module

configuration.nix

@@ -5,7 +5,6 @@
     ./files.nix
     ./volumes.nix
     ./users.nix
-    ./vpn/ocserv.nix
     ./social/pleroma.nix
     ./letsencrypt/acme.nix
     ./letsencrypt/resolve.nix

letsencrypt/acme.nix

@@ -3,7 +3,7 @@ let
   cfg = config.selfprivacy;
 in
 {
-  users.groups.acmereceivers.members = [ "nginx" "ocserv" ];
+  users.groups.acmereceivers.members = [ "nginx" ];
   security.acme = {
     acceptTerms = true;
     defaults = {

sp-modules/ocserv/config-paths-needed.json

@@ -0,0 +1,4 @@
+[
+  [ "selfprivacy", "domain" ],
+  [ "selfprivacy", "modules", "ocserv" ]
+]

sp-modules/ocserv/flake.nix

@@ -0,0 +1,9 @@
+{
+  description = "PoC SP module for OpenConnect VPN server (ocserv)";
+
+  outputs = { self }: {
+    nixosModules.default = import ./module.nix;
+    configPathsNeeded =
+      builtins.fromJSON (builtins.readFile ./config-paths-needed.json);
+  };
+}

sp-modules/ocserv/module.nix

@@ -0,0 +1,59 @@
+{ config, lib, ... }:
+let
+  domain = config.selfprivacy.domain;
+in
+{
+  options.selfprivacy.modules.ocserv = {
+    enable = lib.mkOption {
+      default = false;
+      type = with lib; types.nullOr types.bool;
+    };
+  };
+
+  config = lib.mkIf config.selfprivacy.modules.ocserv.enable {
+    users.groups.ocserv.members = [ "ocserv" ];
+    users.users.ocserv = {
+      isNormalUser = false;
+      isSystemUser = true;
+      extraGroups = [ "acmereceivers" ];
+      group = "ocserv";
+    };
+    services.ocserv = {
+      enable = true;
+      config = ''
+        socket-file = /var/run/ocserv-socket
+
+        auth = "pam"
+
+        tcp-port = 8443
+        udp-port = 8443
+
+        server-cert = /var/lib/acme/${domain}/fullchain.pem
+        server-key = /var/lib/acme/${domain}/key.pem
+
+        compression = true
+
+        max-clients = 0
+        max-same-clients = 6
+
+        try-mtu-discovery = true
+
+        idle-timeout=1200
+        mobile-idle-timeout=2400
+
+        default-domain = vpn.${domain}
+
+        device = vpn0
+
+        ipv4-network = 10.10.10.0
+        ipv4-netmask = 255.255.255.0
+
+        tunnel-all-dns = true
+        dns = 1.1.1.1
+        dns = 1.0.0.1
+
+        route = default
+      '';
+    };
+  };
+}

userdata-variables.nix

@@ -33,9 +33,6 @@ jsonData: { lib, ... }:
     jitsi = {
       enable = lib.attrsets.attrByPath [ "jitsi" "enable" ] false jsonData;
     };
-    ocserv = {
-      enable = lib.attrsets.attrByPath [ "ocserv" "enable" ] false jsonData;
-    };
     ssh = {
       enable = lib.attrsets.attrByPath [ "ssh" "enable" ] true jsonData;
       rootKeys = lib.attrsets.attrByPath [ "ssh" "rootKeys" ] [ "" ] jsonData;

variables-module.nix

@@ -151,12 +151,6 @@ with lib;
         type = types.nullOr types.bool;
       };
     };
-    ocserv = {
-      enable = mkOption {
-        default = true;
-        type = types.nullOr types.bool;
-      };
-    };
     #########
     #  SSH  #
     #########

vpn/ocserv.nix

@@ -1,52 +0,0 @@
-{ config, ... }:
-let
-  domain = config.selfprivacy.domain;
-in
-{
-  users.groups.ocserv = {
-    members = [ "ocserv" ];
-  };
-  users.users.ocserv = {
-    isNormalUser = false;
-    isSystemUser = true;
-    extraGroups = [ "ocserv" "acmereceivers" ];
-    group = "ocserv";
-  };
-  services.ocserv = {
-    enable = config.selfprivacy.ocserv.enable;
-    config = ''
-      socket-file = /var/run/ocserv-socket
-
-      auth = "pam"
-
-      tcp-port = 8443
-      udp-port = 8443
-
-      server-cert = /var/lib/acme/${domain}/fullchain.pem
-      server-key = /var/lib/acme/${domain}/key.pem
-
-      compression = true
-
-      max-clients = 0
-      max-same-clients = 6
-
-      try-mtu-discovery = true
-
-      idle-timeout=1200
-      mobile-idle-timeout=2400
-
-      default-domain = vpn.${domain}
-
-      device = vpn0
-
-      ipv4-network = 10.10.10.0
-      ipv4-netmask = 255.255.255.0
-
-      tunnel-all-dns = true
-      dns = 1.1.1.1
-      dns = 1.0.0.1
-
-      route = default
-    '';
-  };
-}