NixOS Service

NixOS service

The flake exports nixosModules.default and nixosModules.blokebot for declarative deployment.

Import and enable

{
  inputs.blokebot.url = "github:alsi-lawr/BlokeBot";

  outputs =
    { blokebot, nixpkgs, ... }:
    {
      nixosConfigurations.my-host = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux"; # Or aarch64-linux.
        modules = [
          blokebot.nixosModules.default
          {
            services.blokebot = {
              enable = true;
              listenAddress = "127.0.0.1";
              port = 8080;
              environment = {
                TwitchBot__Identity__BotUsername = "my-bot";
                TwitchBot__Identity__ClientId = "public-client-id";
                TwitchBot__Identity__RedirectUri = "https://bot.example.com/oauth/callback";
              };
              environmentFile = "/run/secrets/blokebot.env";
            };
          }
        ];
      };
    };
}

Module options

Option	Default	Purpose
enable	false	Enable the service
package	Current-system flake package	Select the BlokeBot package
listenAddress	127.0.0.1	Dashboard listener address
port	8080	Dashboard TCP port
openFirewall	false	Add the selected port to the NixOS firewall
environment	{}	Non-secret string, integer, or Boolean environment settings
environmentFile	null	Protected systemd environment file for secrets

The module fixes Production mode, listener URL, database path, and token-cache path. Those four values cannot be replaced through services.blokebot.environment.

Service behavior

• User and group: blokebot.
• State directory: /var/lib/blokebot, mode 0700.
• Custom-bot Data Protection keys: managed automatically in the state directory.
• Restart policy: on-failure.
• Starts after and wants network-online.target.
• Hardening: NoNewPrivileges, private temporary directory, protected home and system paths, and only the state directory writable.

Opening the firewall does not change the default loopback listener. Set an externally reachable address only when the dashboard is meant to be exposed, preferably behind a TLS reverse proxy.

Operate

systemctl status blokebot
journalctl --unit blokebot --follow
systemctl restart blokebot