idk dude make this work

.gitignore

···
 dist
 node_modules
+result

flake.nix

···
     nixpkgs,
   }: let
     systems = ["x86_64-linux" "aarch64-linux"];
-  in {
-    packages = nixpkgs.lib.genAttrs systems (system: let
-      pkgs = nixpkgs.legacyPackages.${system};
-    in {
-      default = pkgs.buildNpmPackage {
+
+    mkPackage = pkgs:
+      pkgs.buildNpmPackage {
         pname = "atproto-basic-notifications";
         version = "0.1.0";
         src = ./.;
         npmDepsHash = "sha256-gGiNDtxgof7L5y3bH7VWukezEMZbzYkSDdovUwaKQGA=";
       };
+  in {
+    overlays.default = final: prev: {
+      atproto-basic-notifications = mkPackage final;
+    };
+
+    packages = nixpkgs.lib.genAttrs systems (system: let
+      pkgs = nixpkgs.legacyPackages.${system};
+    in {
+      default = mkPackage pkgs;
     });
+
+    nixosModules.default = {
+      imports = [./module.nix];
+      nixpkgs.overlays = [self.overlays.default];
+    };
   };
 }

module.nix

···
+# copied from here https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/web-apps/bluesky-pds.nix
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}: let
+  cfg = config.services.atproto-basic-notifications;
+
+  inherit
+    (lib)
+    getExe
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+in {
+  options.services.atproto-basic-notifications = {
+    enable = mkEnableOption "basic notification system for atproto stuff";
+
+    package = mkPackageOption pkgs "atproto-basic-notifications" {};
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = types.attrsOf (
+          types.oneOf [
+            (types.nullOr types.str)
+            types.port
+          ]
+        );
+        options = {
+          TARGET_DID = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "The DID of the user to monitor, put yours otherwise you'll be getting all my notifs lol.";
+            example = "did:plc:3c6vkaq7xf5kz3va3muptjh5";
+          };
+
+          JETSTREAM_URL = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "The URL of the jetstream to connect to.";
+            example = "wss://jetstream2.us-east.bsky.network/subscribe";
+          };
+
+          NTFY_URL = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "The URL of the ntfy.sh server for sending notifications, you should definitely change this. If you have a login put this on the environment file thing not here!!!";
+            example = "http://ntfy.sh";
+          };
+
+          BSKY_URL = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "The URL of the Bluesky web client, probably doesn't make sense editing.";
+            example = "https://bsky.app";
+          };
+
+          PDSLS_URL = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "The URL for pdsls.dev, probably doesn't make sense editing.";
+            example = "https://pdsls.dev";
+          };
+
+          TANGLED_URL = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = "The URL for tangled.sh, probably doesn't make sense editing.";
+            example = "https://tangled.sh";
+          };
+        };
+      };
+
+      description = ''
+        Environment variables to set for the service. Secrets should be
+        specified using {option}`environmentFile`.
+
+        Refer to <https://github.com/ayla6/atproto-basic-notifications/blob/main/index.ts> for available environment variables.
+      '';
+    };
+
+    environmentFiles = mkOption {
+      type = types.listOf types.path;
+      default = [];
+      description = "this is where you should put the ntfy url if there's a login or token";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.atproto-basic-notifications = {
+      description = "basic notification system for atproto stuff";
+
+      after = ["network-online.target"];
+      wants = ["network-online.target"];
+      wantedBy = ["multi-user.target"];
+
+      serviceConfig = {
+        ExecStart = getExe cfg.package;
+        Environment =
+          lib.mapAttrsToList (k: v: "${k}=${
+            if builtins.isInt v
+            then toString v
+            else v
+          }") (
+            lib.filterAttrs (_: v: v != null) cfg.settings
+          );
+
+        EnvironmentFile = cfg.environmentFiles;
+        User = "atp-notif";
+        Group = "atp-notif";
+        StateDirectory = "atproto-basic-notifications";
+        StateDirectoryMode = "0755";
+        Restart = "always";
+
+        # Hardening
+        RemoveIPC = true;
+        CapabilityBoundingSet = ["CAP_NET_BIND_SERVICE"];
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        PrivateMounts = true;
+        SystemCallArchitectures = ["native"];
+        MemoryDenyWriteExecute = false; # required by V8 JIT
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictRealtime = true;
+        DeviceAllow = [""];
+        ProtectSystem = "strict";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectHome = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        UMask = "0077";
+      };
+    };
+
+    users = {
+      users.atp-notif = {
+        group = "atp-notif";
+        isSystemUser = true;
+      };
+      groups.atp-notif = {};
+    };
+  };
+}