nixpkgs/nixos/modules/services/databases/dgraph.nix

{
  config,
  pkgs,
  lib,
  ...
}:
let
  cfg = config.services.dgraph;
  settingsFormat = pkgs.formats.json { };
  configFile = settingsFormat.generate "config.json" cfg.settings;
  dgraphWithNode =
    pkgs.runCommand "dgraph"
      {
        nativeBuildInputs = [ pkgs.makeWrapper ];
      }
      ''
        mkdir -p $out/bin
        makeWrapper ${cfg.package}/bin/dgraph $out/bin/dgraph \
          --prefix PATH : "${lib.makeBinPath [ pkgs.nodejs ]}" \
      '';
  securityOptions = {
    NoNewPrivileges = true;

    AmbientCapabilities = "";
    CapabilityBoundingSet = "";

    DeviceAllow = "";

    LockPersonality = true;

    PrivateTmp = true;
    PrivateDevices = true;
    PrivateUsers = true;

    ProtectClock = true;
    ProtectControlGroups = true;
    ProtectHostname = true;
    ProtectKernelLogs = true;
    ProtectKernelModules = true;
    ProtectKernelTunables = true;

    RemoveIPC = true;

    RestrictNamespaces = true;
    RestrictAddressFamilies = [
      "AF_INET"
      "AF_INET6"
      "AF_UNIX"
    ];
    RestrictRealtime = true;
    RestrictSUIDSGID = true;

    SystemCallArchitectures = "native";
    SystemCallErrorNumber = "EPERM";
    SystemCallFilter = [
      "@system-service"
      "~@cpu-emulation"
      "~@debug"
      "~@keyring"
      "~@memlock"
      "~@obsolete"
      "~@privileged"
      "~@setuid"
    ];
  };
in
{
  options = {
    services.dgraph = {
      enable = lib.mkEnableOption "Dgraph native GraphQL database with a graph backend";

      package = lib.mkPackageOption pkgs "dgraph" { };

      settings = lib.mkOption {
        type = settingsFormat.type;
        default = { };
        description = ''
          Contents of the dgraph config. For more details see https://dgraph.io/docs/deploy/config
        '';
      };

      alpha = {
        host = lib.mkOption {
          type = lib.types.str;
          default = "localhost";
          description = ''
            The host which dgraph alpha will be run on.
          '';
        };
        port = lib.mkOption {
          type = lib.types.port;
          default = 7080;
          description = ''
            The port which to run dgraph alpha on.
          '';
        };

      };

      zero = {
        host = lib.mkOption {
          type = lib.types.str;
          default = "localhost";
          description = ''
            The host which dgraph zero will be run on.
          '';
        };
        port = lib.mkOption {
          type = lib.types.port;
          default = 5080;
          description = ''
            The port which to run dgraph zero on.
          '';
        };
      };

    };
  };

  config = lib.mkIf cfg.enable {
    services.dgraph.settings = {
      badger.compression = lib.mkDefault "zstd:3";
    };

    systemd.services.dgraph-zero = {
      description = "Dgraph native GraphQL database with a graph backend. Zero controls node clustering";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
        StateDirectory = "dgraph-zero";
        WorkingDirectory = "/var/lib/dgraph-zero";
        DynamicUser = true;
        ExecStart = "${cfg.package}/bin/dgraph zero --my ${cfg.zero.host}:${toString cfg.zero.port}";
        Restart = "on-failure";
      } // securityOptions;
    };

    systemd.services.dgraph-alpha = {
      description = "Dgraph native GraphQL database with a graph backend. Alpha serves data";
      after = [
        "network.target"
        "dgraph-zero.service"
      ];
      requires = [ "dgraph-zero.service" ];
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
        StateDirectory = "dgraph-alpha";
        WorkingDirectory = "/var/lib/dgraph-alpha";
        DynamicUser = true;
        ExecStart = "${dgraphWithNode}/bin/dgraph alpha --config ${configFile} --my ${cfg.alpha.host}:${toString cfg.alpha.port} --zero ${cfg.zero.host}:${toString cfg.zero.port}";
        ExecStop = ''
          ${pkgs.curl}/bin/curl --data "mutation { shutdown { response { message code } } }" \
              --header 'Content-Type: application/graphql' \
              -X POST \
              http://localhost:8080/admin
        '';
        Restart = "on-failure";
      } // securityOptions;
    };
  };

  meta.maintainers = with lib.maintainers; [ happysalada ];
}