vspd: optionally vendor the webapi (public and templates)

modules/vspd.nix

@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
+  dcrdEnabled = config.services.dcrd.enable or false;
   cfg = config.services.vspd;
 in {
   options.services.vspd = with lib; {
@@ -30,6 +31,12 @@ in {
       description = "State directory for vspd";
     };
 
+    webPath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = "Directory for vspd web assets (public and templates)";
+    };
+
     configFile = mkOption {
       type = types.path;
       description = "Path to vspd.conf";
@@ -42,10 +49,15 @@ in {
       home = cfg.dataDir;
       isSystemUser = true;
       description = "vspd user";
+      # vspd needs read access to the dcrd RPC certificate
+      extraGroups = lib.optional (dcrdEnabled && config.services.dcrd.group != cfg.group) config.services.dcrd.group;
     };
 
     users.groups.${cfg.group} = {};
 
+    systemd.tmpfiles.rules = lib.optional (cfg.webPath != null)
+      "d '${cfg.webPath}' 0755 ${cfg.user} ${cfg.group} - -";
+
     systemd.services.vspd = {
       description = "Voting Service Provider Daemon";
       wantedBy = [ "multi-user.target" ];
@@ -59,7 +71,14 @@ in {
         StateDirectoryMode = "0750";
         WorkingDirectory = cfg.dataDir;
         # Link the provided config file to the expected location in homedir
-        ExecStartPre = "${pkgs.bash}/bin/bash -c 'ln -sf ${cfg.configFile} ${cfg.dataDir}/vspd.conf'";
+        ExecStartPre = "${pkgs.writeShellScript "vspd-pre-start" ''
+          set -e
+          ln -sf ${cfg.configFile} ${cfg.dataDir}/vspd.conf
+          ${lib.optionalString (cfg.webPath != null) ''
+            ln -sfn ${cfg.package}/share/vspd/internal/webapi/public ${cfg.webPath}/public
+            ln -sfn ${cfg.package}/share/vspd/internal/webapi/templates ${cfg.webPath}/templates
+          ''}
+        ''}";
         ExecStart = "${lib.getExe cfg.package} --homedir=${cfg.dataDir}";
         Restart = "on-failure";
         RestartSec = "10s";