nixos/pleroma: add pleroma NixOS module

This module is not trying to configure either postgresql nor nginx.
It's is a design decision, not an omission. A webserver setup can be
highly complex.

The idea is trying not to be smarter than the user, providing them
with a simple tool. They are smart enough to figure the interaction
between the various component by themselves!

The module has one and only job: setting up a pleroma service.

modules/pleroma.nix

@@ -0,0 +1,88 @@
+{ config, lib, pkgs, stdenv }:
+let
+  cfg = config.services.pleroma;
+in {
+  options = {
+    services.pleroma = with lib; {
+      enable = mkEnableOption "pleroma";
+
+      package = mkOption {
+        type = types.package;
+        default = import ../default.nix { inherit pkgs stdenv; };
+        description = "Pleroma package to use.";
+      };
+
+      runMigrationOnStartup = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Run the database migrations on the Pleroma service startup.";
+      };
+
+      dataDir = mkOption {
+        type = types.str;
+        default = "/var/lib/pleroma";
+        description = "Directory storing Pleroma's data.";
+      };
+
+      confDir = mkOption {
+        type = types.str;
+        default = "/etc/pleroma";
+        description = "Directory storing Pleroma's configuration.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "pleroma";
+        description = "User account under which pleroma runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "pleroma";
+        description = "Group account under which pleroma runs.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users = {
+      users."${cfg.user}" = {
+        description = "Pleroma user";
+        createHome = true;
+        home = cfg.dataDir;
+        extraGroups = [ cfg.group ];
+      };
+      groups = {
+        pleroma = {};
+      };
+    };
+
+    systemd.services.pleroma = {
+      description = "Pleroma social network";
+      after = [ "network-online.target" "postgresql.service" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        MIX_ENV = "prod";
+      };
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        Type = "forking";
+        WorkingDirectory = cfg.dataDir;
+        ExecStart = "${cfg.package}/bin/pleroma start";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+
+        # Systemd sandboxing directives.
+        # Taken from the upstream contrib systemd service at
+        # pleroma/installation/pleroma.service
+        PrivateTmp = true;
+        ProtectHome = true;
+        ProtectSystem = "full";
+        PrivateDevices = false;
+        NoNewPrivileges = true;
+        CapabilityBoundingSet = "~CAP_SYS_ADMIN";
+      };
+    };
+
+  };
+}

readme.md

@@ -1,8 +1,33 @@
 # Pleroma on NixOS: OTP Release
 
+## How to Use?
+
+To use this module on your NixOS system, you'll first have to download
+it and include it in your import list.
+
+```
+{ config, pkgs, ... }:
+let
+  pleromaModuleSrc = builtins.fetchTarball {
+    url = "https://git.alternativebit.fr/NinjaTrappeur/pleroma-otp-nixos/archive/master.tar.gz";
+    sha256 = "1rv2m8wg8nkz2cd1i8x7kdwabxxcx73q5w4lq9sgv23z52g4x3bh";
+  };
+in {
+    imports = [
+        "${pleromaModuleSrc}/modules/pleroma.nix"
+    ];
+}
+```
+
+Note: while this will work just fine, I'd recommand using
+[niv](https://github.com/nmattia/niv) to perform this kind of external
+source tracking. It's much more convenient to maintain on the long
+run!
+
 ## TODO
 
-- Add NixOS module.
+- Add nginx config in NixOS module.
+
 
 ## Minor Annoyances