chore(syncplay): move to hakurei

nixos/secrets/syncplay.yaml

@@ -1,4 +1,5 @@
-syncplay-env: ENC[AES256_GCM,data:2u4RT6hJYuDhvRbYVO5t0T0EDnW8QUNdM2krbuJ5WBqKXfTXlIjLb5Bynt5J3/mSSp9DRCggqtXvZaUTxr4Oia5HIms4mxBkUrfareaRNm0=,iv:+IWjGtsmSUfw1wNpSSFA7Kvnhv+lG1F9a6T6N+QLAq8=,tag:ucEwim9yePrgEZOqQKsL2Q==,type:str]
+syncplay-password: ENC[AES256_GCM,data:ZfzBG7SAV3cHoEHRYxqn5dshxP6DZAlXCCDPPYeo1g7aGWghqevotxWw,iv:BQ+V6ZLE/BmY4CfqM+CA+EpkNUx8lzbKzhuJp1J3n60=,tag:ABmwK8y2qwcnCE55CBVeEQ==,type:str]
+syncplay-salt: ENC[AES256_GCM,data:rMxqzmJURbz+prQBwUMoCfOKOPWAxRsowkFrFjZ1ZWVZmvo/Td7kcpzACSlf/al6SSiI/367NBw/bmfyFH5G3w==,iv:zGGPzAOZL3fYRfREpPDxgoZmbyX1LDFSBCaryhTYyP4=,tag:GHATSzdorg9fcuLfy/lPMA==,type:str]
 sops:
     shamir_threshold: 1
     kms: []
@@ -33,8 +34,8 @@ sops:
             QXlqSjU2N3ZvUmlYTXgwNWlJSHhPaVUKmSWxiM269wNw5VBh/OcHa6y21navnYIG
             1hLHyeJFNXmCX/4+gTxjphcUaWc0zYx8duH63L66CTtCK/RT+Kdchg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-01-16T19:11:23Z"
-    mac: ENC[AES256_GCM,data:mev1gtAUq0ujMdYVz4ipkGeyPn/rtLJZx993CVQRxTLVNOIdFkvJlbUwuSKWdZ29r1EdQgqDc7OoPekYfdO/7aMa/AyFoL1e/ohzD1mklGZLTP4YLB3/jB8fkqZUZXCdWtA2Ej1sRlBY2bUZx9rL/FpG9OyWA8zOlItReAEhDPM=,iv:rLXIGy4kY+tMHX6OHFE2DGtFU6niFUFCk/+CadXFP2w=,tag:j0GR5K4yxMQwVUyXCEyJrA==,type:str]
+    lastmodified: "2024-06-23T22:38:07Z"
+    mac: ENC[AES256_GCM,data:pHo5NfYGHV9WEp3SC8uG8M4XKS0qApgWbad9uF9LeANaZw1dDjlGUOVFjnwuXqFBUPT5lPjqxnavgllM8wZjyrIjD4j6QDjsMYmzKfqf1VmZG6TDG75u1VLBlrXQpDqzYzm3ioq2bZISkHkurVaQtY/HSZGOGm1Ltiy6MHySbiA=,iv:ezlHpCHifphzbmPjkvPhl5x2bxOldnRtX+KcP9GUbhI=,tag:Zzpz4wQGv0vti13p09A0vw==,type:str]
     pgp:
         - created_at: "2024-01-19T19:08:56Z"
           enc: |-

nixos/syncplay.nix

@@ -1,45 +1,36 @@
 {
   config,
   lib,
-  pkgs,
-  utils,
   ...
-}:
-with lib; let
+}: let
+  inherit (lib.modules) mkIf mkDefault;
   cfg = config.services.syncplay;
-  args =
-    [
-      "--disable-ready"
-      "--port"
-      cfg.port
-    ]
-    ++ optionals (cfg.certDir != null) ["--tls" cfg.certDir];
 in {
-  sops.secrets.syncplay-env = {
+  sops.secrets = let
     sopsFile = mkDefault ./secrets/syncplay.yaml;
     owner = cfg.user;
-  };
-
-  users.users.${cfg.user} = {
-    inherit (cfg) group;
-    isSystemUser = true;
-    home = "/var/lib/syncplay";
-  };
-  users.groups.${cfg.group} = {};
-
-  networking.firewall.interfaces.local.allowedTCPPorts = [cfg.port];
+  in
+    mkIf cfg.enable {
+      syncplay-password = {
+        inherit sopsFile owner;
+      };
+      syncplay-salt = {
+        inherit sopsFile owner;
+      };
+    };
 
   services.syncplay = {
-    enable = true;
-    user = "syncplay";
+    enable = mkDefault true;
+    extraArgs = [
+      "--disable-ready"
+    ];
+    user = mkDefault "syncplay";
+    group = mkDefault "syncplay";
+    saltFile = mkDefault config.sops.secrets.syncplay-salt.path;
+    passwordFile = mkDefault config.sops.secrets.syncplay-password.path;
   };
-  systemd.services.syncplay = mkIf cfg.enable {
-    serviceConfig = {
-      StateDirectory = "syncplay";
-      EnvironmentFile = singleton config.sops.secrets.syncplay-env.path;
-      ExecStart = mkForce [
-        "${pkgs.syncplay-nogui}/bin/syncplay-server ${utils.escapeSystemdExecArgs args}"
-      ];
-    };
+
+  networking.firewall = mkIf (cfg.enable && !cfg.openFirewall) {
+    interfaces.local.allowedTCPPorts = [cfg.port];
   };
 }