Move nix code into separate files and directory and create basic module

nix/module.nix

@@ -0,0 +1,124 @@
+{
+  config,
+  lib,
+  pkgs,
+  archtikaPackages,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.archtika;
+in
+{
+  options.services.archtika = {
+    enable = mkEnableOption "archtika service";
+
+    user = mkOption {
+      type = types.str;
+      default = "archtika";
+      description = "User account under which archtika runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "archtika";
+      description = "Group under which archtika runs.";
+    };
+
+    databaseName = mkOption {
+      type = types.str;
+      default = "archtika";
+      description = "Name of the PostgreSQL database for archtika.";
+    };
+
+    jwtSecret = mkOption {
+      type = types.str;
+      description = "JWT secret for archtika.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 3000;
+      description = "Port on which the API runs.";
+    };
+
+    webAppPort = mkOption {
+      type = types.port;
+      default = 4000;
+      description = "Port on which the web application runs.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      group = cfg.group;
+      home = "/var/lib/archtika";
+      createHome = true;
+    };
+
+    users.groups.${cfg.group} = { };
+
+    systemd.services.archtika-api = {
+      description = "archtika API service";
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+        "postgresql.service"
+      ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        Restart = "always";
+      };
+
+      script = ''
+        ${pkgs.postgresql_16}/bin/psql postgres://postgres@localhost:5432/${cfg.databaseName} -c "ALTER DATABASE ${cfg.databaseName} SET \"app.jwt_secret\" TO '${cfg.jwtSecret}'"
+
+        ${pkgs.dbmate}/bin/dbmate --url postgres://postgres@localhost:5432/archtika?sslmode=disable --migrations-dir ${archtikaPackages.api}/migrations up
+
+        PGRST_SERVER_PORT=${toString cfg.port} PGRST_DB_SCHEMAS="api" PGRST_DB_ANON_ROLE="anon" PGRST_OPENAPI_MODE="ignore-privileges" PGRST_DB_URI="postgres://authenticator@localhost:5432/${cfg.databaseName}" PGRST_JWT_SECRET="${cfg.jwtSecret}" ${pkgs.postgrest}/bin/postgrest
+      '';
+    };
+
+    systemd.services.archtika-web = {
+      description = "archtika Web App service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        Restart = "always";
+      };
+
+      script = ''
+        ORIGIN=http://localhost:${toString cfg.webAppPort} PORT=${toString cfg.webAppPort} ${pkgs.nodejs_22}/bin/node ${archtikaPackages.web}
+      '';
+    };
+
+    services.postgresql = {
+      enable = true;
+      package = pkgs.postgresql_16;
+      ensureDatabases = [ cfg.databaseName ];
+      authentication = lib.mkForce ''
+        # IPv4 local connections:
+        host    all    all    127.0.0.1/32    trust
+        # IPv6 local connections:
+        host    all    all    ::1/128         trust
+        # Local socket connections:
+        local   all    all                    trust
+      '';
+      extraPlugins = with pkgs.postgresql16Packages; [ pgjwt ];
+    };
+
+    services.nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+    };
+  };
+}