modules/pds/nixos.nix: iron things out

modules/pds/nixos.nix

···
   config,
   lib,
   pkgs,
+  options,
   ...
 }:
 let
···
 
   litestreamConfig = pkgs.writeText "litestream-pds-config.yml" ''
     dbs:
-      - dir: ${cfg.pdsDataDir}
+      - dir: ${cfg.dataDir}
         pattern: "*.sqlite"
         recursive: true
         watch: true
         replica:
           type: s3
-          path: ${cfg.s3Prefix}
+          path: ${cfg.backupS3Prefix}
           bucket: ''${S3_BUCKET}
   '';
 
···
         fi
 
         s3Bucket="''${S3_BUCKET}"
-        s3Prefix="${cfg.s3Prefix}"
+        s3Prefix="${cfg.backupS3Prefix}"
 
         run_aws() {
           local envArgs=()
···
         echo "$databases"
         echo ""
 
-        mkdir -p "${cfg.pdsDataDir}"
+        mkdir -p "${cfg.dataDir}"
 
         local restoredCount=0
         for db in $databases; do
-          local localPath="${cfg.pdsDataDir}/$db"
+          local localPath="${cfg.dataDir}/$db"
           local s3DbPath="$s3Prefix/$db"
           local s3DbUrl="s3://$s3Bucket/$s3DbPath"
 
···
       exit 1
     fi
 
-    if [ -f "${cfg.pdsDataDir}/primary.sqlite" ]; then
+    if [ -f "${cfg.dataDir}/primary.sqlite" ]; then
       if ! systemctl is-active --quiet litestream-pds; then
         echo "[PDS HealthCheck] Litestream service is not running"
         exit 1
···
   options.services.pds-with-backups = {
     enable = mkEnableOption "Zero-Touch Recovery PDS with Litestream and S3 blob storage";
 
-    domain = mkOption {
-      type = types.str;
-      description = "PDS domain name (e.g., bsky.example.com).";
-      example = "bsky.example.com";
-    };
-
-    pdsDataDir = mkOption {
-      type = types.str;
+    dataDir = mkOption {
+      type = types.path;
       default = "/var/lib/pds";
       description = "PDS data directory for SQLite databases.";
     };
···
       example = [ "/run/secrets/pds.env" ];
     };
 
-    s3Prefix = mkOption {
+    backupS3Prefix = mkOption {
       type = types.strMatching "[^/].*[^/]";
-      default = "pds";
+      default = "backups";
       description = "S3 directory prefix for Litestream replicas.";
       example = "pds-backups";
     };
 
-    pdsSettings = mkOption {
-      type = types.attrs;
+    backupLogDir = mkOption {
+      type = types.path;
+      default = "/var/log/pds-backup";
+      description = "Directory for backup and restore logs.";
+      internal = true;
+    };
+
+    settings = mkOption {
+      type = options.services.bluesky-pds.settings.type;
       default = { };
-      description = "Additional settings to pass to bluesky-pds.";
+      description = "Additional settings to pass to bluesky-pds:\n\n" ++ options.services.bluesky-pds.settings.description;
       example = {
         PDS_PORT = 3000;
-        PDS_DISABLE_PHONE_VERIFICATION = "true";
+        PDS_HOSTNAME = "hi.example.com";
       };
-    };
-
-    backupLogDir = mkOption {
-      type = types.path;
-      default = "/var/log/pds-backup";
-      description = "Directory for backup and restore logs.";
     };
   };
 
···
       enable = mkDefault true;
       settings = mkMerge [
         {
-          PDS_HOSTNAME = cfg.domain;
           PDS_SQLITE_DISABLE_WAL_AUTO_CHECKPOINT = "true";
-          PDS_DATA_DIRECTORY = cfg.pdsDataDir;
+          PDS_DATA_DIRECTORY = cfg.dataDir;
         }
-        cfg.pdsSettings
+        cfg.settings
       ];
       environmentFiles = secretsFiles;
     };
···
     users.groups.${pdsGroup} = { };
 
     systemd.tmpfiles.rules = [
-      "d ${cfg.pdsDataDir} 0755 ${pdsUser} ${pdsGroup} -"
+      "d ${cfg.dataDir} 0755 ${pdsUser} ${pdsGroup} -"
       "d ${cfg.backupLogDir} 0755 ${pdsUser} ${pdsGroup} -"
     ];
 
···
         Type = "oneshot";
         ExecStart = "${restoreScript}/bin/pds-litestream-restore";
         EnvironmentFile = secretsFiles;
-        User = "root";
-        Group = "root";
+        User = pdsUser;
+        Group = pdsGroup;
         RemainAfterExit = true;
 
         NoNewPrivileges = true;
···
         ProtectSystem = "strict";
         ProtectHome = true;
         ReadWritePaths = [
-          cfg.pdsDataDir
+          cfg.dataDir
           cfg.backupLogDir
         ];
         RestrictRealtime = true;
···
       serviceConfig = {
         Type = "oneshot";
         ExecStart = healthCheckScript;
-        User = "root";
-        Group = "root";
+        User = pdsUser;
+        Group = pdsGroup;
 
         NoNewPrivileges = true;
         ProtectSystem = "strict";

modules/pds/pds-recovery-full.nix

···
   nodes.machine =
     { pkgs, ... }:
     {
-      imports = [ ./default.nix ];
+      imports = [ ./nixos.nix ];
 
       services.minio = {
         enable = true;
···
 
       systemd.tmpfiles.rules = [
         "f /tmp/minio-credentials 0600 root root - MINIO_ROOT_USER=minioadmin\\nMINIO_ROOT_PASSWORD=minioadmin123"
-        "f /run/secrets/s3.env 0600 root root - AWS_ACCESS_KEY_ID=minioadmin\\nAWS_SECRET_ACCESS_KEY=minioadmin123\\nAWS_ENDPOINT_URL=http://127.0.0.1:9000\\nS3_BUCKET=pds-test-bucket"
-        "f /run/secrets/pds.env 0600 root root - PDS_JWT_SECRET=test-jwt-secret-for-full-testing\\nPDS_ADMIN_PASSWORD=test-admin-password\\nPDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=1111111111111111111111111111111111111111111111111111111111111111"
+        "f /run/secrets/s3.env 0600 pds pds - AWS_ACCESS_KEY_ID=minioadmin\\nAWS_SECRET_ACCESS_KEY=minioadmin123\\nAWS_ENDPOINT_URL=http://127.0.0.1:9000\\nS3_BUCKET=pds-test-bucket"
+        "f /run/secrets/pds.env 0600 pds pds - PDS_JWT_SECRET=test-jwt-secret-for-full-testing\\nPDS_ADMIN_PASSWORD=test-admin-password\\nPDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=1111111111111111111111111111111111111111111111111111111111111111"
       ];
 
       services.pds-with-backups = {
         enable = true;
-        domain = "test.example.com";
-        pdsDataDir = "/var/lib/pds";
         secretsFiles = [
           "/run/secrets/pds.env"
           "/run/secrets/s3.env"
         ];
-        s3Bucket = "pds-test-bucket";
-        s3Prefix = "pds-replica";
-        enableStatelessBlobs = false;
-        pdsSettings = {
-          PDS_PORT = 3000;
-          PDS_DISABLE_PHONE_VERIFICATION = "true";
+        backupS3Prefix = "pds-replica";
+        settings = {
+          PDS_HOSTNAME = "advanced.example.com";
         };
       };
 
···
     print("\n--- Setting up MinIO ---")
     machine.wait_for_unit("minio.service")
     machine.wait_for_open_port(9000)
-    machine.succeed("sleep 5")
 
     machine.succeed("test -f /tmp/minio-credentials")
     machine.succeed("test -f /run/secrets/s3.env")
···
     machine.wait_for_unit("bluesky-pds.service")
     machine.wait_for_open_port(3000)
 
-    machine.succeed("sleep 30")
-
     health_response = machine.succeed("curl -s http://127.0.0.1:3000/xrpc/_health")
     try:
         health_data = json.loads(health_response)
···
     print("  [PASS] Litestream service is running")
 
     print("\n--- Test 3: Database creation ---")
-    machine.succeed("sleep 30")
     pds_files = machine.succeed("ls -la /var/lib/pds/")
     print(f"  Files in /var/lib/pds: {pds_files}")
 
···
     machine.succeed("systemctl start bluesky-pds")
     machine.wait_for_unit("bluesky-pds.service")
     machine.wait_for_open_port(3000)
-    machine.succeed("sleep 30")
 
     health_response2 = machine.succeed("curl -s http://127.0.0.1:3000/xrpc/_health")
     try:
···
     print("\n--- Test 7: Litestream resumption ---")
     machine.succeed("systemctl start litestream-pds")
     machine.wait_for_unit("litestream-pds.service")
-    machine.succeed("sleep 10")
 
     final_minio = machine.succeed("mc ls local/pds-test-bucket/pds-replica/ --recursive 2>/dev/null")
     assert ".sqlite" in final_minio, "Expected ongoing replication"
···
 
     print("\n--- Test 8: Health check service ---")
     machine.succeed("systemctl start pds-healthcheck")
-    machine.succeed("sleep 2")
     health_log = machine.succeed("journalctl -u pds-healthcheck.service -o cat 2>/dev/null || true")
     assert "All services healthy" in health_log, f"Expected health check message, got: {health_log}"
     print("  [PASS] Health check service working")

modules/pds/pds-recovery-simple.nix

···
   nodes.machine =
     { pkgs, lib, ... }:
     {
-      imports = [ ./default.nix ];
+      imports = [ ./nixos.nix ];
 
       services.pds-with-backups = {
         enable = true;
-        domain = "test.example.com";
-        pdsDataDir = "/var/lib/pds";
         secretsFiles = [
           "/run/secrets/pds.env"
           "/run/secrets/s3.env"
         ];
-        s3Bucket = "test-bucket";
-        s3Prefix = "test-pds";
-        enableStatelessBlobs = false;
-        pdsSettings = {
-          PDS_PORT = 3000;
-          PDS_DISABLE_PHONE_VERIFICATION = "true";
+        backupS3Prefix = "test-pds";
+        settings = {
+          PDS_HOSTNAME = "example.com";
         };
       };
 
       systemd.tmpfiles.rules = [
-        "f /run/secrets/pds.env 0644 root root - PDS_JWT_SECRET=test-jwt-secret\nPDS_ADMIN_PASSWORD=test-password\nPDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=0000000000000000000000000000000000000000000000000000000000000000"
-        "f /run/secrets/s3.env 0644 root root - AWS_ACCESS_KEY_ID=test-key\nAWS_SECRET_ACCESS_KEY=test-secret\nAWS_ENDPOINT_URL=https://s3.test.example.com\nS3_BUCKET=test-bucket"
+        "f /run/secrets/pds.env 0644 pds pds - PDS_JWT_SECRET=test-jwt-secret\nPDS_ADMIN_PASSWORD=test-password\nPDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=0000000000000000000000000000000000000000000000000000000000000000"
+        "f /run/secrets/s3.env 0644 pds pds - AWS_ACCESS_KEY_ID=test-key\nAWS_SECRET_ACCESS_KEY=test-secret\nAWS_ENDPOINT_URL=https://s3.test.example.com\nS3_BUCKET=test-bucket"
       ];
 
       services.bluesky-pds.enable = true;

systems/reg/pds.nix

···
       format = "dotenv";
       sopsFile = ../../secrets/pds.env;
       restartUnits = [ "bluesky-pds.service" ];
+      owner = "pds";
+      group = "pds";
     };
     secrets.cloudflare-api = {
       format = "dotenv";
···
 
   services.pds-with-backups = {
     enable = true;
-    domain = "0xf.fr";
     secretsFiles = [ config.sops.secrets.pds.path ];
-    s3Prefix = "backups";
-
-    pdsSettings = {
-      PDS_PORT = 3000;
+    settings = {
+      PDS_HOSTNAME = "0xf.fr";
       PDS_BLOBSTORE_DISK_LOCATION = null;
     };
   };