systant/nix/nixos-module.nix

{ config, lib, pkgs, ... }:

with lib;

let
  cfg = config.services.systant;
in
{
  options.services.systant = {
    enable = mkEnableOption "Systant MQTT Daemon";

    package = mkOption {
      type = types.package;
      description = "The systant package to use";
    };

    mqttHost = mkOption {
      type = types.str;
      default = "localhost";
      description = "MQTT broker hostname";
    };

    mqttPort = mkOption {
      type = types.int;
      default = 1883;
      description = "MQTT broker port";
    };

    mqttUsername = mkOption {
      type = types.nullOr types.str;
      default = null;
      description = "MQTT username (null for no auth)";
    };

    mqttPassword = mkOption {
      type = types.nullOr types.str;
      default = null;
      description = "MQTT password (null for no auth)";
    };

    statsTopic = mkOption {
      type = types.str;
      default = "systant/${config.networking.hostName}/stats";
      description = "MQTT topic for publishing stats";
    };

    commandTopic = mkOption {
      type = types.str;
      default = "systant/${config.networking.hostName}/commands";
      description = "MQTT topic for receiving commands";
    };

    publishInterval = mkOption {
      type = types.int;
      default = 30000;
      description = "Interval between stats publications (milliseconds)";
    };
  };

  config = mkIf cfg.enable {
    systemd.services.systant = {
      description = "Systant MQTT Daemon";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

      environment = {
        SYSTANT_MQTT_HOST = cfg.mqttHost;
        SYSTANT_MQTT_PORT = toString cfg.mqttPort;
        SYSTANT_MQTT_USERNAME = mkIf (cfg.mqttUsername != null) cfg.mqttUsername;
        SYSTANT_MQTT_PASSWORD = mkIf (cfg.mqttPassword != null) cfg.mqttPassword;
        SYSTANT_STATS_TOPIC = cfg.statsTopic;
        SYSTANT_COMMAND_TOPIC = cfg.commandTopic;
        SYSTANT_PUBLISH_INTERVAL = toString cfg.publishInterval;
        # Override RELEASE_COOKIE to bypass file reading
        RELEASE_COOKIE = "systant-bypass-cookie";
      };

      serviceConfig = {
        Type = "exec";
        User = "root";
        Group = "root";
        ExecStart = "${cfg.package}/bin/systant start";
        ExecStop = "${cfg.package}/bin/systant stop";
        Restart = "always";
        RestartSec = 5;
        StandardOutput = "journal";
        StandardError = "journal";
        SyslogIdentifier = "systant";
        WorkingDirectory = "${cfg.package}";

        # Security settings
        NoNewPrivileges = true;
        PrivateTmp = true;
        ProtectHome = true;
        ProtectSystem = false; # Need access to system stats
      };
    };
  };
}