feat(users/rus07tam): enable openclaw gateway via systemd

hosts/elaris/machine.nix

@@ -1,2 +1,2 @@
 {
-}
+}

hosts/velarion/machine.nix

@@ -1,11 +1,13 @@
-{dns, ...}: let
+{ dns, ... }:
+let
   domain = "ruject.fun";
   database = {
     host = "127.0.0.1";
     port = 5432;
   };
   ipv4 = "94.156.112.0";
-in {
+in
+{
   services.nginx.enable = true;
   machine = {
     gateway = "10.0.0.1";
@@ -29,7 +31,7 @@ in {
             "ns2"
           ];
 
-          A = [ipv4];
+          A = [ ipv4 ];
 
           subdomains = rec {
             ns1 = host ipv4 null;
@@ -52,10 +54,10 @@ in {
           };
 
           TXT = [
-            (with spf; strict ["a:mail.ruject.fun"])
+            (with spf; strict [ "a:mail.ruject.fun" ])
           ];
 
-          MX = with mx; [(mx 10 "mail.ruject.fun.")];
+          MX = with mx; [ (mx 10 "mail.ruject.fun.") ];
 
           DMARC = [
             {

services/bind/firewall.nix

@@ -6,7 +6,8 @@
 let
   cfg = config.machine.bind;
 in
-with lib; mkIf cfg.enable {
+with lib;
+mkIf cfg.enable {
   networking.firewall = {
     allowedTCPPorts = [ cfg.port ];
     allowedUDPPorts = [ cfg.port ];

services/bind/service.nix

@@ -7,7 +7,8 @@
 let
   cfg = config.machine.bind;
 in
-with lib; mkIf cfg.enable {
+with lib;
+mkIf cfg.enable {
   services.bind = {
     enable = cfg.enable;
     listenOnPort = cfg.port;

services/code-server/nginx.nix

@@ -6,7 +6,8 @@
 let
   cfg = config.machine.code-server;
 in
-with lib; mkIf cfg.enable {
+with lib;
+mkIf cfg.enable {
   services.nginx.virtualHosts = mkIf (cfg.domain != null) {
     ${cfg.domain} = {
       enableACME = true;

services/code-server/options.nix

@@ -6,7 +6,8 @@
 let
   cfg = config.machine.code-server;
 in
-with lib; {
+with lib;
+{
   options.machine.code-server = {
     enable = mkEnableOption "code-server";
     port = mkOption {

services/code-server/service.nix

@@ -7,7 +7,8 @@
 let
   cfg = config.machine.code-server;
 in
-with lib; mkIf cfg.enable {
+with lib;
+mkIf cfg.enable {
   services.code-server = {
     enable = cfg.enable;
     port = cfg.port;

services/coturn/firewall.nix

@@ -6,7 +6,8 @@
 let
   cfg = config.machine.coturn;
 in
-with lib; mkIf cfg.enable {
+with lib;
+mkIf cfg.enable {
   networking.firewall = {
     interfaces.enp2s0 =
       let

services/coturn/service.nix

@@ -12,7 +12,8 @@ let
     realm
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.coturn = rec {
     inherit realm enable;
     no-cli = true;

services/forgejo/mail.nix

@@ -9,7 +9,8 @@ let
   inherit (config.machine.forgejo) domain;
   address = "noreply@${domain}";
 in
-with lib; mkIf config.machine.mail.enable {
+with lib;
+mkIf config.machine.mail.enable {
   services.forgejo = {
     secrets = {
       mailer.PASSWD = sec."mail/servicePassword".path;

services/forgejo/network.nix

@@ -10,19 +10,22 @@ let
     port
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   networking.firewall = {
     allowedTCPPorts = [ port ];
   };
 
-  services.nginx.virtualHosts = with lib; mkIf (domain != null) {
+  services.nginx.virtualHosts =
-    "${domain}" = {
+    with lib;
-      forceSSL = true;
+    mkIf (domain != null) {
-      enableACME = true;
+      "${domain}" = {
-      locations."/" = {
+        forceSSL = true;
-        proxyPass = "http://[::1]:${toString port}";
+        enableACME = true;
-        proxyWebsockets = true;
+        locations."/" = {
+          proxyPass = "http://[::1]:${toString port}";
+          proxyWebsockets = true;
+        };
       };
     };
-  };
 }

services/forgejo/runners.nix

@@ -9,7 +9,8 @@ let
   url = config.services.forgejo.settings.server.ROOT_URL;
   cfg = config.machine.forgejo;
 in
-with lib; mkIf cfg.enableRunner {
+with lib;
+mkIf cfg.enableRunner {
   sops.secrets = {
     "forgejo/runnerToken" = {
       sopsFile = ./../../secrets/common.yaml;

services/forgejo/tmpfiles.nix

@@ -7,7 +7,8 @@ let
   cfg = config.machine.forgejo;
   customDir = config.services.forgejo.customDir;
 in
-with lib; mkIf cfg.enable {
+with lib;
+mkIf cfg.enable {
   systemd.tmpfiles.rules = [
     "d '${customDir}/templates' - forgejo forgejo - -"
     "d '${customDir}/public' - forgejo forgejo - -"

services/mail/rspamd.nix

@@ -6,7 +6,8 @@
 let
   inherit (config.machine.mail) enable;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.rspamd = {
     enable = true;
     overrides = {

services/mail/tmpfiles.nix

@@ -7,7 +7,8 @@
 let
   inherit (config.machine.mail) enable;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   systemd.tmpfiles.rules = [
     "C /var/dkim/default.private 0600 root root - - ${sec.dkim_default_private.path}"
   ];

services/minecraft-server/firewall.nix

@@ -9,7 +9,8 @@ let
     port
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   networking.firewall.allowedTCPPorts = [
     port
   ];

services/minecraft-server/service.nix

@@ -10,7 +10,8 @@ let
     port
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.minecraft-server = {
     inherit enable;
     dataDir = "/var/lib/minecraft";

services/mysql/firewall.nix

@@ -6,7 +6,8 @@
 let
   cfg = config.machine.mysql;
 in
-with lib; mkIf cfg.enable {
+with lib;
+mkIf cfg.enable {
   networking.firewall = {
     allowedTCPPorts = [ cfg.port ];
   };

services/mysql/service.nix

@@ -10,7 +10,8 @@ let
     enable
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.mysql = {
     inherit enable;
     package = pkgs.mysql84;

services/navidrome/service.nix

@@ -11,17 +11,20 @@ let
     folder
     ;
 in
-with lib; mkIf enable {
+with lib;
-  services.nginx.virtualHosts = with lib; mkIf (domain != null) {
+mkIf enable {
-    "${domain}" = {
+  services.nginx.virtualHosts =
-      forceSSL = true;
+    with lib;
-      enableACME = true;
+    mkIf (domain != null) {
-      locations."/" = {
+      "${domain}" = {
-        proxyPass = "http://[::1]:${toString port}";
+        forceSSL = true;
-        proxyWebsockets = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://[::1]:${toString port}";
+          proxyWebsockets = true;
+        };
       };
     };
-  };
 
   services.navidrome = {
     inherit enable;

services/networking/default.nix

@@ -3,4 +3,4 @@
     ./options.nix
     ./service.nix
   ];
-}
+}

services/networking/service.nix

@@ -1,8 +1,14 @@
-{ config, lib, hostname, ... }:
+{
+  config,
+  lib,
+  hostname,
+  ...
+}:
 let
   inherit (config.machine) ipv4 gateway;
 in
-with lib; {
+with lib;
+{
   networking = {
     hostName = hostname;
     networkmanager.enable = mkDefault true;

services/nextcloud/database.nix

@@ -7,7 +7,8 @@ let
   pgsqlEnable = config.machine.postgresql.enable;
   cfg = config.machine.nextcloud;
 in
-with lib; mkIf cfg.enable {
+with lib;
+mkIf cfg.enable {
   services.nextcloud.config =
     if pgsqlEnable then
       {
@@ -20,13 +21,15 @@ with lib; mkIf cfg.enable {
         dbhost = "localhost";
       };
 
-  services.postgresql = with lib; mkIf pgsqlEnable {
+  services.postgresql =
-    ensureDatabases = [ "nextcloud" ];
+    with lib;
-    ensureUsers = [
+    mkIf pgsqlEnable {
-      {
+      ensureDatabases = [ "nextcloud" ];
-        name = "nextcloud";
+      ensureUsers = [
-        ensureDBOwnership = true;
+        {
-      }
+          name = "nextcloud";
-    ];
+          ensureDBOwnership = true;
-  };
+        }
+      ];
+    };
 }

services/nextcloud/mail.nix

@@ -11,7 +11,8 @@ let
     ;
   address = "noreply@${host}";
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.nextcloud = {
     settings = {
       mail_smtpmode = "smtp";

services/nextcloud/service.nix

@@ -8,7 +8,8 @@
 let
   cfg = config.machine.nextcloud;
 in
-with lib; mkIf cfg.enable {
+with lib;
+mkIf cfg.enable {
   services.nextcloud = {
     enable = cfg.enable;
     appstoreEnable = false;

services/nginx/acme.nix

@@ -1,5 +1,6 @@
 { lib, config, ... }:
-with lib; mkIf (config.services.nginx.enable) {
+with lib;
+mkIf (config.services.nginx.enable) {
   security.acme = {
     acceptTerms = true;
     defaults = {

services/nginx/firewall.nix

@@ -6,7 +6,8 @@
 let
   inherit (config.services.nginx) enable;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   networking.firewall.allowedTCPPorts = [
     80
     443

services/postgresql/service.nix

@@ -10,7 +10,8 @@ let
     enable
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.postgresql = {
     inherit enable;
     settings = {

services/prometheus/service.nix

@@ -9,7 +9,8 @@ let
     port
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.prometheus = {
     inherit enable port;
   };

services/prosody/firewall.nix

@@ -8,7 +8,8 @@ let
     enable
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   networking.firewall = {
     allowedTCPPorts = [
       # HTTP filer

services/prosody/nginx.nix

@@ -11,7 +11,8 @@ let
 
   localhost = "http://localhost:5280";
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   security.acme.certs."${domain}".extraDomainNames = [
     "conference.${domain}"
     "upload.${domain}"
@@ -19,36 +20,38 @@ with lib; mkIf enable {
   users.groups.acme.members = [
     "prosody"
   ];
-  services.nginx.virtualHosts = with lib; mkIf (domain != null) {
+  services.nginx.virtualHosts =
-    "${domain}".locations = {
+    with lib;
-      "= /xmpp-websocket" = {
+    mkIf (domain != null) {
-        proxyPass = localhost;
+      "${domain}".locations = {
-        proxyWebsockets = true;
+        "= /xmpp-websocket" = {
+          proxyPass = localhost;
+          proxyWebsockets = true;
+        };
+        "= /http-bind".proxyPass = localhost;
+        "/push".proxyPass = localhost;
+        "= /.well-known/host-meta".proxyPass = localhost;
+        "= /.well-known/host-meta.json".proxyPass = localhost;
+      };
+      "conference.${domain}" = {
+        http3 = true;
+        quic = true;
+        forceSSL = true;
+        kTLS = true;
+        useACMEHost = domain;
+        sslCertificate = "${config.security.acme.certs.${domain}.directory}/fullchain.pem";
+        sslCertificateKey = "${config.security.acme.certs.${domain}.directory}/key.pem";
+        locations."/".proxyPass = localhost;
+      };
+      "upload.${domain}" = {
+        http3 = true;
+        quic = true;
+        forceSSL = true;
+        kTLS = true;
+        useACMEHost = domain;
+        sslCertificate = "${config.security.acme.certs.${domain}.directory}/fullchain.pem";
+        sslCertificateKey = "${config.security.acme.certs.${domain}.directory}/key.pem";
+        locations."/".proxyPass = localhost;
       };
-      "= /http-bind".proxyPass = localhost;
-      "/push".proxyPass = localhost;
-      "= /.well-known/host-meta".proxyPass = localhost;
-      "= /.well-known/host-meta.json".proxyPass = localhost;
     };
-    "conference.${domain}" = {
-      http3 = true;
-      quic = true;
-      forceSSL = true;
-      kTLS = true;
-      useACMEHost = domain;
-      sslCertificate = "${config.security.acme.certs.${domain}.directory}/fullchain.pem";
-      sslCertificateKey = "${config.security.acme.certs.${domain}.directory}/key.pem";
-      locations."/".proxyPass = localhost;
-    };
-    "upload.${domain}" = {
-      http3 = true;
-      quic = true;
-      forceSSL = true;
-      kTLS = true;
-      useACMEHost = domain;
-      sslCertificate = "${config.security.acme.certs.${domain}.directory}/fullchain.pem";
-      sslCertificateKey = "${config.security.acme.certs.${domain}.directory}/key.pem";
-      locations."/".proxyPass = localhost;
-    };
-  };
 }

services/prosody/service.nix

@@ -12,7 +12,8 @@ let
 
   sslCertDir = config.security.acme.certs."${domain}".directory;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.prosody = {
     inherit enable;
 

services/redis/service.nix

@@ -10,7 +10,8 @@ let
     enable
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   sops.secrets = {
     "redis/password" = { };
   };

services/roundcube/service.nix

@@ -10,7 +10,8 @@ let
     domain
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.roundcube = {
     inherit enable;
     dicts = with pkgs.aspellDicts; [

services/synapse/database.nix

@@ -7,20 +7,25 @@ let
   pgsqlEnable = config.machine.postgresql.enable;
   inherit (config.machine.synapse) enable;
 in
-with lib; mkIf enable {
+with lib;
-  services.postgresql = with lib; mkIf pgsqlEnable {
+mkIf enable {
-    ensureUsers = [
+  services.postgresql =
-      {
+    with lib;
-        name = "matrix-synapse";
+    mkIf pgsqlEnable {
-        ensureDBOwnership = true;
+      ensureUsers = [
-      }
+        {
-    ];
+          name = "matrix-synapse";
-    ensureDatabases = [ "matrix-synapse" ];
+          ensureDBOwnership = true;
-  };
+        }
+      ];
+      ensureDatabases = [ "matrix-synapse" ];
+    };
   services.matrix-synapse.settings.database = {
     name = if pgsqlEnable then "psycopg2" else "sqlite3";
-    args = with lib; mkIf pgsqlEnable {
+    args =
-      host = "/run/postgresql";
+      with lib;
-    };
+      mkIf pgsqlEnable {
+        host = "/run/postgresql";
+      };
   };
 }

services/synapse/element.nix

@@ -52,7 +52,8 @@ let
     };
   };
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.nginx.virtualHosts.${domain} = {
     enableACME = true;
     forceSSL = true;

services/synapse/mail.nix

@@ -11,7 +11,8 @@ let
     ;
   address = "noreply@${domain}";
 in
-with lib; mkIf (enable && config.machine.mail.enable) {
+with lib;
+mkIf (enable && config.machine.mail.enable) {
   services.matrix-synapse = {
     settings = {
       admin_contact = address;

services/synapse/redis.nix

@@ -7,7 +7,8 @@ let
   redisEnable = config.machine.redis.enable;
   inherit (config.machine.synapse) enable;
 in
-with lib; mkIf (redisEnable && enable) {
+with lib;
+mkIf (redisEnable && enable) {
   services.redis.servers.matrix-synapse = {
     enable = true;
   };

services/synapse/secrets.nix

@@ -8,7 +8,8 @@ let
     enable
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   sops.secrets = {
     "matrix/registrationSharedSecret" = {
       sopsFile = ./../../secrets/common.yaml;
@@ -40,7 +41,9 @@ with lib; mkIf enable {
         smtp_pass: ${config.sops.placeholder."mail/servicePassword"}
     '';
   };
-  services.matrix-synapse.extraConfigFiles = with lib; mkIf config.machine.synapse.enable [
+  services.matrix-synapse.extraConfigFiles =
-    config.sops.templates.matrix-synapse-config.path
+    with lib;
-  ];
+    mkIf config.machine.synapse.enable [
+      config.sops.templates.matrix-synapse-config.path
+    ];
 }

services/synapse/synapse.nix

@@ -12,7 +12,8 @@ let
     metrics
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.matrix-synapse = {
     inherit enable;
     enableRegistrationScript = true;

services/synapse/turn.nix

@@ -6,7 +6,8 @@
 let
   inherit (config.machine.coturn) enable;
 in
-with lib; mkIf (enable && config.machine.coturn.enable) {
+with lib;
+mkIf (enable && config.machine.coturn.enable) {
   services.matrix-synapse.settings = with config.services.coturn; {
     turn_uris = [
       "turn:${realm}:3478?transport=udp"

services/uptime-kuma/service.nix

@@ -10,7 +10,8 @@ let
     port
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   services.uptime-kuma = {
     inherit enable;
     settings = {
@@ -18,16 +19,18 @@ with lib; mkIf enable {
     };
   };
 
-  services.nginx.virtualHosts = with lib; mkIf (domain != null) {
+  services.nginx.virtualHosts =
-    "${domain}" = {
+    with lib;
-      forceSSL = true;
+    mkIf (domain != null) {
-      enableACME = true;
+      "${domain}" = {
-      locations."/" = {
+        forceSSL = true;
-        proxyPass = "http://127.0.0.1:${toString port}";
+        enableACME = true;
-        proxyWebsockets = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString port}";
+          proxyWebsockets = true;
+        };
       };
     };
-  };
 
   networking.firewall = {
     allowedTCPPorts = [ port ];

services/vaultwarden/service.nix

@@ -10,34 +10,37 @@ let
     port
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   networking.firewall = {
     allowedTCPPorts = [ port ];
   };
 
-  services.nginx.virtualHosts = with lib; mkIf (domain != null) {
+  services.nginx.virtualHosts =
-    "${domain}" = {
+    with lib;
-      forceSSL = true;
+    mkIf (domain != null) {
-      enableACME = true;
+      "${domain}" = {
-      locations."/" = {
+        forceSSL = true;
-        proxyPass = "http://127.0.0.1:${toString port}";
+        enableACME = true;
-        proxyWebsockets = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString port}";
+          proxyWebsockets = true;
+          extraConfig = ''
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Host $host;
+          '';
+        };
+
         extraConfig = ''
-          proxy_set_header X-Real-IP $remote_addr;
+          add_header X-Frame-Options DENY;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          add_header X-Content-Type-Options nosniff;
-          proxy_set_header X-Forwarded-Proto $scheme;
+          add_header Referrer-Policy same-origin;
-          proxy_set_header X-Forwarded-Host $host;
+          add_header X-XSS-Protection "1; mode=block";
         '';
       };
-
-      extraConfig = ''
-        add_header X-Frame-Options DENY;
-        add_header X-Content-Type-Options nosniff;
-        add_header Referrer-Policy same-origin;
-        add_header X-XSS-Protection "1; mode=block";
-      '';
     };
-  };
 
   services.vaultwarden = {
     inherit enable;

services/xray-3x-ui/firewall.nix

@@ -9,7 +9,8 @@ let
     port
     ;
 in
-with lib; mkIf enable {
+with lib;
+mkIf enable {
   networking.firewall.allowedTCPPorts = [
     # Web panel
     port

services/xray-3x-ui/nginx.nix

@@ -2,43 +2,50 @@
   lib,
   config,
   ...
-}: let
+}:
-  inherit
+let
-    (config.machine.xray-3x-ui)
+  inherit (config.machine.xray-3x-ui)
     enable
     port
     domain
     subscriptions
     ;
-in {
+in
-  services.nginx.virtualHosts = with lib; mkIf enable {
+{
-    ${domain} = with lib; mkIf (domain != null) {
+  services.nginx.virtualHosts =
-      enableACME = true;
+    with lib;
-      forceSSL = true;
+    mkIf enable {
-      locations."/" = {
+      ${domain} =
-        proxyPass = "http://127.0.0.1:${toString port}";
+        with lib;
-        proxyWebsockets = true;
+        mkIf (domain != null) {
-        extraConfig = ''
+          enableACME = true;
-          proxy_set_header X-Real-IP         $remote_addr;
+          forceSSL = true;
-          proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+          locations."/" = {
-          proxy_set_header X-Forwarded-Proto $scheme;
+            proxyPass = "http://127.0.0.1:${toString port}";
-          proxy_redirect off;
+            proxyWebsockets = true;
-        '';
+            extraConfig = ''
-      };
+              proxy_set_header X-Real-IP         $remote_addr;
+              proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_redirect off;
+            '';
+          };
+        };
+      ${subscriptions.domain} =
+        with lib;
+        mkIf (subscriptions.domain != null) {
+          enableACME = true;
+          forceSSL = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:2096";
+            proxyWebsockets = true;
+            extraConfig = ''
+              proxy_set_header X-Real-IP         $remote_addr;
+              proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_redirect off;
+            '';
+          };
+        };
     };
-    ${subscriptions.domain} = with lib; mkIf (subscriptions.domain != null) {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:2096";
-        proxyWebsockets = true;
-        extraConfig = ''
-          proxy_set_header X-Real-IP         $remote_addr;
-          proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-          proxy_set_header X-Forwarded-Proto $scheme;
-          proxy_redirect off;
-        '';
-      };
-    };
-  };
 }

services/xray-3x-ui/options.nix

@@ -30,4 +30,4 @@ with lib;
       description = "Directory to store 3x-ui data.";
     };
   };
-}
+}

services/xray-3x-ui/service.nix

@@ -1,6 +1,11 @@
 # See https://github.com/sunmeplz/xray-3x-ui
 
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 
@@ -11,8 +16,7 @@ let
   minGoVersion = "1.26.0";
 
   xray-3x-ui =
-    assert assertMsg
+    assert assertMsg (versionAtLeast pkgs.go.version minGoVersion)
-      (versionAtLeast pkgs.go.version minGoVersion)
       "3x-ui requires Go >= ${minGoVersion}, but ${pkgs.go.version} is available";
 
     pkgs.buildGoModule rec {
@@ -28,7 +32,10 @@ let
 
       vendorHash = "sha256-M8YQTMfF/xZut4hxUcAfF2xGK625vwJNp4JS/zoXUCQ=";
 
-      ldflags = [ "-s" "-w" ];
+      ldflags = [
+        "-s"
+        "-w"
+      ];
 
       meta = with lib; {
         description = "Xray panel supporting multi-protocol multi-user";
@@ -39,7 +46,8 @@ let
       };
     };
 
-in {
+in
+{
   # Service implementation
   config = mkIf cfg.enable {
     # User and group configuration
@@ -85,8 +93,14 @@ in {
         Group = "xray-3x-ui";
         StateDirectory = "3x-ui 3x-ui/bin 3x-ui/logs";
         StateDirectoryMode = "0755";
-        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_NET_ADMIN" ];
+        AmbientCapabilities = [
-        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_NET_ADMIN" ];
+          "CAP_NET_BIND_SERVICE"
+          "CAP_NET_ADMIN"
+        ];
+        CapabilityBoundingSet = [
+          "CAP_NET_BIND_SERVICE"
+          "CAP_NET_ADMIN"
+        ];
       };
     };
 

users/rus07tam/modules/openclaw/service.nix

@@ -7,6 +7,7 @@
   programs.openclaw = {
     enable = true;
     installApp = false;
+    systemd.enable = true;
 
     bundledPlugins = {
       summarize.enable = true;