nixpkgs/nixos/modules/services/networking/gateone.nix

{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.services.gateone;
in
{
  options = {
    services.gateone = {
      enable = lib.mkEnableOption "GateOne server";
      pidDir = lib.mkOption {
        default = "/run/gateone";
        type = lib.types.path;
        description = "Path of pid files for GateOne.";
      };
      settingsDir = lib.mkOption {
        default = "/var/lib/gateone";
        type = lib.types.path;
        description = "Path of configuration files for GateOne.";
      };
    };
  };
  config = lib.mkIf cfg.enable {
    environment.systemPackages = with pkgs.pythonPackages; [
      gateone
      pkgs.openssh
      pkgs.procps
      pkgs.coreutils
      pkgs.cacert
    ];

    users.users.gateone = {
      description = "GateOne privilege separation user";
      uid = config.ids.uids.gateone;
      home = cfg.settingsDir;
    };
    users.groups.gateone.gid = config.ids.gids.gateone;

    systemd.services.gateone = with pkgs; {
      description = "GateOne web-based terminal";
      path = [
        pythonPackages.gateone
        nix
        openssh
        procps
        coreutils
      ];
      preStart = ''
        if [ ! -d ${cfg.settingsDir} ] ; then
          mkdir -m 0750 -p ${cfg.settingsDir}
          chown -R gateone:gateone ${cfg.settingsDir}
        fi
        if [ ! -d ${cfg.pidDir} ] ; then
          mkdir -m 0750 -p ${cfg.pidDir}
          chown -R gateone:gateone ${cfg.pidDir}
        fi
      '';
      #unitConfig.RequiresMountsFor = "${cfg.settingsDir}";
      serviceConfig = {
        ExecStart = ''${pythonPackages.gateone}/bin/gateone --settings_dir=${cfg.settingsDir} --pid_file=${cfg.pidDir}/gateone.pid --gid=${toString config.ids.gids.gateone} --uid=${toString config.ids.uids.gateone}'';
        User = "gateone";
        Group = "gateone";
        WorkingDirectory = cfg.settingsDir;
      };

      wantedBy = [ "multi-user.target" ];
      requires = [ "network.target" ];
    };
  };
}