nixpkgs/nixos/modules/services/networking/webhook.nix

{
  config,
  lib,
  pkgs,
  ...
}:

with lib;

let
  cfg = config.services.webhook;
  defaultUser = "webhook";

  hookFormat = pkgs.formats.json { };

  hookType = types.submodule (
    { name, ... }:
    {
      freeformType = hookFormat.type;
      options = {
        id = mkOption {
          type = types.str;
          default = name;
          description = ''
            The ID of your hook. This value is used to create the HTTP endpoint (`protocol://yourserver:port/prefix/''${id}`).
          '';
        };
        execute-command = mkOption {
          type = types.str;
          description = "The command that should be executed when the hook is triggered.";
        };
      };
    }
  );

  hookFiles =
    mapAttrsToList (name: hook: hookFormat.generate "webhook-${name}.json" [ hook ]) cfg.hooks
    ++ mapAttrsToList (
      name: hook: pkgs.writeText "webhook-${name}.json.tmpl" "[${hook}]"
    ) cfg.hooksTemplated;

in
{
  options = {
    services.webhook = {
      enable = mkEnableOption ''
        [Webhook](https://github.com/adnanh/webhook), a server written in Go that allows you to create HTTP endpoints (hooks),
        which execute configured commands for any person or service that knows the URL
      '';

      package = mkPackageOption pkgs "webhook" { };
      user = mkOption {
        type = types.str;
        default = defaultUser;
        description = ''
          Webhook will be run under this user.

          If set, you must create this user yourself!
        '';
      };
      group = mkOption {
        type = types.str;
        default = defaultUser;
        description = ''
          Webhook will be run under this group.

          If set, you must create this group yourself!
        '';
      };
      ip = mkOption {
        type = types.str;
        default = "0.0.0.0";
        description = ''
          The IP webhook should serve hooks on.

          The default means it can be reached on any interface if `openFirewall = true`.
        '';
      };
      port = mkOption {
        type = types.port;
        default = 9000;
        description = "The port webhook should be reachable from.";
      };
      openFirewall = mkOption {
        type = types.bool;
        default = false;
        description = ''
          Open the configured port in the firewall for external ingress traffic.
          Preferably the Webhook server is instead put behind a reverse proxy.
        '';
      };
      enableTemplates = mkOption {
        type = types.bool;
        default = cfg.hooksTemplated != { };
        defaultText = literalExpression "hooksTemplated != {}";
        description = ''
          Enable the generated hooks file to be parsed as a Go template.
          See [the documentation](https://github.com/adnanh/webhook/blob/master/docs/Templates.md) for more information.
        '';
      };
      urlPrefix = mkOption {
        type = types.str;
        default = "hooks";
        description = ''
          The URL path prefix to use for served hooks (`protocol://yourserver:port/''${prefix}/hook-id`).
        '';
      };
      hooks = mkOption {
        type = types.attrsOf hookType;
        default = { };
        example = {
          echo = {
            execute-command = "echo";
            response-message = "Webhook is reachable!";
          };
          redeploy-webhook = {
            execute-command = "/var/scripts/redeploy.sh";
            command-working-directory = "/var/webhook";
          };
        };
        description = ''
          The actual configuration of which hooks will be served.

          Read more on the [project homepage] and on the [hook definition] page.
          At least one hook needs to be configured.

          [hook definition]: https://github.com/adnanh/webhook/blob/master/docs/Hook-Definition.md
          [project homepage]: https://github.com/adnanh/webhook#configuration
        '';
      };
      hooksTemplated = mkOption {
        type = types.attrsOf types.str;
        default = { };
        example = {
          echo-template = ''
            {
              "id": "echo-template",
              "execute-command": "echo",
              "response-message": "{{ getenv "MESSAGE" }}"
            }
          '';
        };
        description = ''
          Same as {option}`hooks`, but these hooks are specified as literal strings instead of Nix values,
          and hence can include [template syntax](https://github.com/adnanh/webhook/blob/master/docs/Templates.md)
          which might not be representable as JSON.

          Template syntax requires the {option}`enableTemplates` option to be set to `true`, which is
          done by default if this option is set.
        '';
      };
      verbose = mkOption {
        type = types.bool;
        default = true;
        description = "Whether to show verbose output.";
      };
      extraArgs = mkOption {
        type = types.listOf types.str;
        default = [ ];
        example = [ "-secure" ];
        description = ''
          These are arguments passed to the webhook command in the systemd service.
          You can find the available arguments and options in the [documentation][parameters].

          [parameters]: https://github.com/adnanh/webhook/blob/master/docs/Webhook-Parameters.md
        '';
      };
      environment = mkOption {
        type = types.attrsOf types.str;
        default = { };
        description = "Extra environment variables passed to webhook.";
      };
    };
  };

  config = mkIf cfg.enable {
    assertions =
      let
        overlappingHooks = builtins.intersectAttrs cfg.hooks cfg.hooksTemplated;
      in
      [
        {
          assertion = hookFiles != [ ];
          message = "At least one hook needs to be configured for webhook to run.";
        }
        {
          assertion = overlappingHooks == { };
          message = "`services.webhook.hooks` and `services.webhook.hooksTemplated` have overlapping attribute(s): ${concatStringsSep ", " (builtins.attrNames overlappingHooks)}";
        }
      ];

    users.users = mkIf (cfg.user == defaultUser) {
      ${defaultUser} = {
        isSystemUser = true;
        group = cfg.group;
        description = "Webhook daemon user";
      };
    };

    users.groups = mkIf (cfg.user == defaultUser && cfg.group == defaultUser) {
      ${defaultUser} = { };
    };

    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];

    systemd.services.webhook = {
      description = "Webhook service";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      environment = config.networking.proxy.envVars // cfg.environment;
      script =
        let
          args =
            [
              "-ip"
              cfg.ip
              "-port"
              (toString cfg.port)
              "-urlprefix"
              cfg.urlPrefix
            ]
            ++ concatMap (hook: [
              "-hooks"
              hook
            ]) hookFiles
            ++ optional cfg.enableTemplates "-template"
            ++ optional cfg.verbose "-verbose"
            ++ cfg.extraArgs;
        in
        ''
          ${cfg.package}/bin/webhook ${escapeShellArgs args}
        '';
      serviceConfig = {
        Restart = "on-failure";
        User = cfg.user;
        Group = cfg.group;
      };
    };
  };
}