trying some stuff

modules/nixos/services/persistance/convex/default.nix

@@ -0,0 +1,21 @@
+{ config, pkgs, lib, namespace, ... }:
+let
+  inherit (lib) mkIf mkEnableOption;
+
+  cfg = config.${namespace}.services.persistance.convex;
+in
+{
+  imports = [ ./source.nix ];
+
+  options.${namespace}.services.persistance.convex = {
+    enable = mkEnableOption "enable Convex";
+  };
+
+  config = mkIf cfg.enable {
+    services.convex = {
+      enable = true;
+      package = pkgs.${namespace}.convex;
+      secret = "ThisIsMyAwesomeSecret";
+    };
+  };
+}

modules/nixos/services/persistance/convex/source.nix

@@ -0,0 +1,149 @@
+{ config, pkgs, lib, namespace, ... }:
+let
+  inherit (lib) mkIf mkEnableOption mkPackageOption mkOption optional types;
+
+  cfg = config.services.convex;
+
+  default_user = "convex";
+  default_group = "convex";
+in
+{
+  options.services.convex = {
+    enable = mkEnableOption "enable Convex (backend only for now)";
+
+    package = mkPackageOption pkgs "convex" {};
+
+    name = lib.mkOption {
+      type = types.str;
+      default = "convex";
+      description = ''
+        Name for the instance.
+      '';
+    };
+
+    secret = lib.mkOption {
+      type = types.str;
+      default = "";
+      description = ''
+        Secret for the instance.
+      '';
+    };
+
+    apiPort = mkOption {
+      type = types.port;
+      default = 3210;
+      description = ''
+        The TCP port to use for the API.
+      '';
+    };
+
+    actionsPort = mkOption {
+      type = types.port;
+      default = 3211;
+      description = ''
+        The TCP port to use for the HTTP actions.
+      '';
+    };
+
+    dashboardPort = mkOption {
+      type = types.port;
+      default = 6791;
+      description = ''
+        The TCP port to use for the Dashboard.
+      '';
+    };
+
+    openFirewall = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to open ports in the firewall for the server.
+      '';
+    };
+
+    user = lib.mkOption {
+      type = types.str;
+      default = default_user;
+      description = ''
+        As which user to run the service.
+      '';
+    };
+
+    group = lib.mkOption {
+      type = types.str;
+      default = default_group;
+      description = ''
+        As which group to run the service.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.secret != "";
+        message = ''
+          No secret provided for convex
+        '';
+      }
+    ];
+
+    users = {
+      users.${cfg.user} = {
+        description = "System user for convex service";
+        isSystemUser = true;
+        group = cfg.group;
+      };
+
+      groups.${cfg.group} = {};
+    };
+
+    networking.firewall.allowedTCPPorts = optional cfg.openFirewall [ cfg.apiPort cfg.actionsPort cfg.dashboardPort ];
+    
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.convex = {
+      description = "Convex Backend server";
+
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin --instance-name ${cfg.name} --instance-secret ${cfg.secret}";
+        Type = "notify";
+
+        User = cfg.user;
+        Group = cfg.group;
+
+        RuntimeDirectory = "convex";
+        RuntimeDirectoryMode = "0775";
+        StateDirectory = "convex";
+        StateDirectoryMode = "0775";
+        Umask = "0077";
+
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+
+        # Sandboxing
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+      };
+    };
+  };
+}

packages/convex/default.nix

@@ -0,0 +1,59 @@
+{ 
+  lib, 
+  stdenv, 
+  rustPlatform, 
+  fetchFromGitHub, 
+  
+  # dependencies
+  openssl, 
+  pkg-config, 
+  cmake,
+  llvmPackages,
+  postgresql, 
+  sqlite, 
+  
+  #options
+  dbBackend ? "postgresql", 
+
+  ... 
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "convex";
+  version = "2025-08-20-c9b561e";
+
+  src = fetchFromGitHub {
+    owner = "get-convex";
+    repo = "convex-backend";
+    rev = "c9b561e1b365c85ef28af35d742cb7dd174b5555";
+    hash = "sha256-4h4AQt+rQ+nTw6eTbbB5vqFt9MFjKYw3Z7bGXdXijJ0=";
+  };
+
+  cargoHash = "sha256-pcDNWGrk9D0qcF479QAglPLFDZp27f8RueP5/lq9jho=";
+
+  cargoBuildFlags = [
+    "-p" "local_backend"
+    "--bin" "convex-local-backend"
+  ];
+
+  env = {
+    LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  };
+
+  strictDeps = true;
+
+  # Build-time dependencies
+  nativeBuildInputs = [ pkg-config cmake rustPlatform.bindgenHook ];
+
+  # Run-time dependencies
+  buildInputs = 
+    [ openssl ]
+    ++ lib.optional (dbBackend == "sqlite") sqlite
+    ++ lib.optional (dbBackend == "postgresql") postgresql;
+
+  buildFeatures = "";
+
+  meta = with lib; {
+    license = licenses.fsl11Asl20;
+    mainProgram = "convex";
+  };
+}

systems/x86_64-linux/ulmo/default.nix

@@ -24,6 +24,8 @@
         promtail.enable = true;
       };
 
+      persistance.convex.enable = true;
+
       security.vaultwarden.enable = true;
     };