feat(nixos): add CrateDocs MCP service module
Some checks failed
Rust / build (push) Failing after 15s
Some checks failed
Rust / build (push) Failing after 15s
- Introduced a NixOS module for configuring the CrateDocs MCP server. - Added options for enabling the service, setting the port, user, and group. - Configured a hardened systemd service with security restrictions.
This commit is contained in:
parent
ec38ec5e96
commit
8440fc1c9a
2 changed files with 68 additions and 0 deletions
67
config.nix
Normal file
67
config.nix
Normal file
|
@ -0,0 +1,67 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.cratedocs-mcp;
|
||||
in
|
||||
{
|
||||
options.services.cratedocs-mcp = {
|
||||
enable = lib.mkEnableOption "CrateDocs MCP server";
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 3000;
|
||||
description = "Port to listen on for HTTP/SSE server";
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "cratedocs-mcp";
|
||||
description = "User to run the service as";
|
||||
};
|
||||
|
||||
group = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "cratedocs-mcp";
|
||||
description = "Group to run the service as";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.cratedocs-mcp = {
|
||||
description = "CrateDocs MCP server";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = "${lib.getExe pkgs.cratedocs-mcp} --port ${toString cfg.port}";
|
||||
Restart = "always";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
DynamicUser = true;
|
||||
StateDirectory = "cratedocs-mcp";
|
||||
CacheDirectory = "cratedocs-mcp";
|
||||
|
||||
# Security hardening
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
NoNewPrivileges = true;
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
RemoveIPC = true;
|
||||
PrivateMounts = true;
|
||||
ProtectHostname = true;
|
||||
ProtectClock = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectControlGroups = true;
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||
SystemCallFilter = "@system-service";
|
||||
SystemCallErrorNumber = "EPERM";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
|
@ -42,5 +42,6 @@
|
|||
default = cratedocs-mcp;
|
||||
};
|
||||
};
|
||||
nixosModules.default = import ./config.nix;
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue