Fava, setup service; enable for Juri

hosts/juri/host.nix

@@ -65,6 +65,11 @@ in {
     server.domain = "ginko.woach.me";
   };
 
+  fava = {
+    enable = true;
+    port = "5128";
+  };
+
   syncthing = {
     enable = true;
     devices = {

nixosModules/services/fava/service.nix

@@ -0,0 +1,45 @@
+{ config, pkgs, lib, ... }:
+
+{
+  options.fava = {
+    enable = lib.mkEnableOption "Enables fava double entry accounting";
+    ledgerFile = lib.mkOption { default = "/var/lib/fava/ledger.beancount"; };
+    port = lib.mkOption { default = "5000"; };
+    host = lib.mkOption { default = "localhost"; };
+  };
+
+  config = lib.mkIf config.fava.enable {
+    systemd.services.fava = {
+      description = "Fava";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.fava}/bin/fava --port ${config.fava.port} --host ${config.fava.host} ${config.fava.ledgerFile}";
+        Type = "simple";
+        User = "fava";
+        Group = "fava";
+        Restart = "on-failure";
+        RestartSec = "5s";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHome = true;
+        ProtectSystem = "full";
+        ReadWriteDirectories = "/var/lib/fava";
+      };
+    };
+
+    users.users.fava = {
+      home = "/var/lib/fava";
+      createHome = true;
+      isSystemUser = true;
+      group = "fava";
+    };
+    users.groups.fava = {};
+
+    system.extraPkgs = [
+      pkgs.beancount
+    ];
+  };
+}