Separate triage and test-tracking modules

flake.nix

 {
   inputs.nixpkgs.url = "github:bgamari/nixpkgs/nixos-22.05-ghc";
   outputs = inputs@{ self, nixpkgs, ... }: {
-    nixosModules.default = import ./nixos.nix;
+    nixosModules.ghc-triage = import ./triage-module.nix;
+    nixosModules.ghc-test-tracking = import ./test-tracking-module.nix;
   };
 }

test-tracking-module.nix

+{ pkgs, config, lib, ... }:
+
+let service = pkgs.python3Packages.callPackage ./package.nix {};
+in
+{
+  options.services.ghc-test-tracking = {
+    accessToken = lib.mkOption {
+      type = lib.types.str;
+    };
+    listenPort = lib.mkOption {
+      type = lib.types.int;
+      default = 8087;
+    };
+  };
+
+  config = {
+    systemd.services.gitlab-test-tracking = {
+      description = "GitLab test tracking service";
+      after = [ "postgresql.service" ];
+      requires = [ "postgresql.service" ];
+      script = ''
+        ${service}/bin/gitlab-test-tracking-service \
+          --gitlab-root=https://gitlab.${config.ghc.rootDomain} \
+          --access-token="${config.services.ghc-test-tracking.accessToken}" \
+          --port=${toString config.services.ghc-test-tracking.listenPort} \
+          --conn-string="postgresql:///ghc_test_tracking"
+      '';
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig.DynamicUser = true;
+    };
+  };
+}

nixos.nix → triage-module.nix

-{ pkgs, config, ... }:
+{ pkgs, config, lib, ... }:
 
-let
-  accessToken = config.ghc-bot.gitlabAccessToken;
-
-  service = pkgs.python3Packages.callPackage ./package.nix {};
-
-  triage-service = {
-    systemd.services.gitlab-triage-label-service = {
-      description = "GitLab label triage service";
-      script = ''
-        ${service}/bin/gitlab-triage-label-service \
-          --gitlab-root=https://gitlab.${config.ghc.rootDomain} \
-          --access-token="${accessToken}" \
-          --port=8085
-      '';
-      wantedBy = [ "multi-user.target" ];
+let service = pkgs.python3Packages.callPackage ./package.nix {};
+in
+{
+  options.services.ghc-triage = {
+    accessToken = lib.mkOption {
+      type = lib.types.str;
+    };
+    listenPort = lib.mkOption {
+      type = lib.types.int;
+      default = 8085;
     };
   };
 
-  test-tracking-service = {
+  config = {
     users.users.ghc-test-tracking = {
       description = "GitLab test tracking service";
       isSystemUser = true;
@@ -26,26 +21,16 @@ let
     };
     users.groups.ghc-test-tracking = {};
       
-    systemd.services.gitlab-test-tracking = {
+    systemd.services.gitlab-triage-label-service = {
+      description = "GitLab label triage service";
       serviceConfig.User = "ghc-test-tracking";
-      description = "GitLab test tracking service";
-      after = [ "postgresql.service" ];
-      requires = [ "postgresql.service" ];
       script = ''
-        ${service}/bin/gitlab-test-tracking-service \
+        ${service}/bin/gitlab-triage-label-service \
           --gitlab-root=https://gitlab.${config.ghc.rootDomain} \
-          --access-token="${accessToken}" \
-          --port=8087 \
-          --conn-string="postgresql:///ghc_test_tracking"
+          --access-token="${config.services.ghc-triage.accessToken}" \
+          --port=${toString config.services.ghc-triage.listenPort}
       '';
       wantedBy = [ "multi-user.target" ];
     };
   };
-
-in {
-  options.ghc-bot.gitlabAccessToken = pkgs.lib.mkOption {
-    type = pkgs.lib.types.str;
-    description = "GitLab access token for ghc-bot";
-  };
-  imports = [ triage-service test-tracking-service ];
 }