initial commit

services/redis/default.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./options.nix
+    ./service.nix
+  ];
+}

services/redis/options.nix

@@ -0,0 +1,12 @@
+{ lib, ... }:
+with lib;
+{
+  options.machine.redis = {
+    enable = mkEnableOption "Redis";
+    port = mkOption {
+      type = types.port;
+      default = 6379;
+      description = "Port to listen on.";
+    };
+  };
+}

services/redis/service.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  sec,
+  ...
+}:
+let
+  inherit (config.machine.redis)
+    port
+    enable
+    ;
+in
+with lib; mkIf enable {
+  sops.secrets = {
+    "redis/password" = { };
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ port ];
+  };
+
+  services.redis.servers."default" = {
+    inherit enable;
+    inherit port;
+    bind = null;
+    requirePassFile = sec."redis/password".path;
+  };
+}