Add nixosModule

nix/module.nix

@@ -0,0 +1,65 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  settingsFormat = pkgs.format.toml { };
+
+  settingsFile = settingsFormat.generate "labmon.toml" config.labmon.settings;
+in
+{
+  options.labmon = {
+    enable = lib.mkEnableOption "Enable labmon";
+
+    settings = lib.mkOption {
+      type = lib.types.attrs;
+      description = ''
+        Settings for labmon.
+      '';
+    };
+  };
+
+  systemd.services.labmon = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+
+    serviceConfig = {
+      ExecStart = "${pkgs.labmon}/bin/labmon ${settingsFile}";
+      DynamicUser = true;
+      Restart = "always";
+
+      # Hardening
+      DevicePolicy = "strict";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "full";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+    };
+  };
+}