From e30ee35619434c64c699a5732589e141afebb8a8 Mon Sep 17 00:00:00 2001
From: Yifei Sun <ysun@hey.com>
Date: Mon, 27 Oct 2025 10:37:24 +0100
Subject: [PATCH] nixos/go-csp-collector: init module

---
 nixos/modules/module-list.nix                 |   1 +
 .../services/monitoring/go-csp-collector.nix  | 106 ++++++++++++++++++
 2 files changed, 107 insertions(+)
 create mode 100644 nixos/modules/services/monitoring/go-csp-collector.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 36ccab4792b2..5a1d97e6d296 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -990,6 +990,7 @@
   ./services/monitoring/gitwatch.nix
   ./services/monitoring/glances.nix
   ./services/monitoring/glpi-agent.nix
+  ./services/monitoring/go-csp-collector.nix
   ./services/monitoring/goss.nix
   ./services/monitoring/grafana-image-renderer.nix
   ./services/monitoring/grafana-reporter.nix
diff --git a/nixos/modules/services/monitoring/go-csp-collector.nix b/nixos/modules/services/monitoring/go-csp-collector.nix
new file mode 100644
index 000000000000..6fafbb840740
--- /dev/null
+++ b/nixos/modules/services/monitoring/go-csp-collector.nix
@@ -0,0 +1,106 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.go-csp-collector;
+
+  inherit (lib)
+    boolToString
+    concatStringsSep
+    getExe
+    isBool
+    literalExpression
+    maintainers
+    mapAttrsToList
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+
+  settingsToArgs =
+    settings:
+    concatStringsSep " " (
+      mapAttrsToList (
+        name: value:
+        let
+          flag = "-${name}";
+        in
+        if isBool value then "${flag}=${boolToString value}" else "${flag} ${toString value}"
+      ) settings
+    );
+in
+{
+  meta.maintainers = with maintainers; [ stepbrobd ];
+
+  options.services.go-csp-collector = {
+    enable = mkEnableOption "go-csp-collector, a content security policy violation collector";
+
+    package = mkPackageOption pkgs "go-csp-collector" { };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType =
+          with types;
+          attrsOf (oneOf [
+            bool
+            path
+            str
+          ]);
+
+        options = {
+          port = mkOption {
+            type = types.port;
+            description = "The port to listen on.";
+            default = 8080;
+            example = 8080;
+          };
+
+          output-format = mkOption {
+            type = types.enum [
+              "text"
+              "json"
+            ];
+            description = "Define how the violation reports are formatted for output.";
+            default = "text";
+            example = "text";
+          };
+        };
+      };
+
+      description = ''
+        Settings for go-csp-collector. See
+        <https://github.com/jacobbednarz/go-csp-collector> for supported options.
+      '';
+
+      default = { };
+
+      example = literalExpression ''
+        {
+          debug = true;
+          health-check-path = "/health";
+        }
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.packages = [ cfg.package ];
+    systemd.services.go-csp-collector = {
+      description = "CSP violation collector";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      serviceConfig = {
+        ReadOnlyPaths = cfg.settings.filter-file or "";
+        ExecStart = [
+          ""
+          "${getExe cfg.package} ${settingsToArgs cfg.settings}"
+        ];
+      };
+    };
+  };
+}