Setup checker

modules/checker.nix

@@ -0,0 +1,53 @@
+{ config, pkgs, checker, ... }:
+
+let
+  checkerPkg = checker.packages.${pkgs.stdenv.hostPlatform.system}.default;
+in
+{
+  users.users.checker = {
+    isSystemUser = true;
+    group = "checker";
+    home = "/var/lib/checker";
+    createHome = true;
+  };
+
+  users.groups.checker = {};
+
+  sops.secrets."checker/env" = {
+    owner = "checker";
+    group = "checker";
+    mode = "0400";
+  };
+
+  systemd.services.checker = {
+    description = "Checker a personal assistant";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+
+    serviceConfig = {
+      User = "checker";
+      Group = "checker";
+      WorkingDirectory = "/var/lib/checker";
+      ExecStart = "${checkerPkg}/bin/checker";
+      EnvironmentFile = config.sops.secrets."checker/env".path;
+
+      Restart = "always";
+      RestartSec = 5;
+
+      NowNewPrivileges = true;
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      ReadWritePaths = [ "/var/lib/checker" ];
+    };
+  };
+
+  services.nginx.virtualHosts."checker.tobiasostner.de" = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:3001";
+    };
+  };
+}