Guildhall alpha: co-op idle game

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

module.nix

@@ -0,0 +1,97 @@
+self: { config, lib, pkgs, ... }:
+let
+  cfg = config.services.guildhall;
+  database = "/var/lib/guildhall/guildhall.sqlite3";
+  hardening = {
+    User = "guildhall";
+    Group = "guildhall";
+    StateDirectory = "guildhall";
+    StateDirectoryMode = "0700";
+    UMask = "0077";
+    NoNewPrivileges = true;
+    PrivateTmp = true;
+    PrivateDevices = true;
+    ProtectSystem = "strict";
+    ProtectHome = true;
+    ProtectKernelTunables = true;
+    ProtectKernelModules = true;
+    ProtectControlGroups = true;
+    RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+  };
+in
+{
+  options.services.guildhall = {
+    enable = lib.mkEnableOption "the Guildhall co-op idle game";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
+      defaultText = lib.literalExpression "guildhall.packages.${pkgs.stdenv.hostPlatform.system}.default";
+      description = "The guildhall package to run.";
+    };
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8098;
+      description = "Loopback TCP port used by the game.";
+    };
+    userHeader = lib.mkOption {
+      type = lib.types.str;
+      default = "Remote-User";
+      description = "Request header carrying the signed-in user, set by the authenticating proxy.";
+    };
+    backup = {
+      directory = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "Directory for nightly world snapshots; null disables backups.";
+      };
+      keep = lib.mkOption {
+        type = lib.types.ints.positive;
+        default = 30;
+        description = "Number of nightly snapshots to keep.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      users.users.guildhall = {
+        isSystemUser = true;
+        group = "guildhall";
+        description = "Guildhall service user";
+      };
+      users.groups.guildhall = { };
+
+      systemd.services.guildhall = {
+        description = "Guildhall co-op idle game";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = hardening // {
+          ExecStart = "${cfg.package}/bin/guildhall --host 127.0.0.1 --port ${toString cfg.port} --db ${database} --user-header ${lib.escapeShellArg cfg.userHeader}";
+          Restart = "on-failure";
+          RestartSec = 3;
+        };
+      };
+    }
+    (lib.mkIf (cfg.backup.directory != null) {
+      systemd.tmpfiles.rules = [ "d ${cfg.backup.directory} 0700 guildhall guildhall -" ];
+
+      systemd.services.guildhall-backup = {
+        description = "Snapshot the Guildhall world";
+        unitConfig.RequiresMountsFor = [ cfg.backup.directory ];
+        serviceConfig = hardening // {
+          Type = "oneshot";
+          ExecStart = "${cfg.package}/bin/guildhall --db ${database} --backup-to ${cfg.backup.directory} --keep ${toString cfg.backup.keep}";
+          ReadWritePaths = [ cfg.backup.directory ];
+        };
+      };
+
+      systemd.timers.guildhall-backup = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-* 03:20:00";
+          Persistent = true;
+        };
+      };
+    })
+  ]);
+}