Export modules

4 files changed, 179 insertions, 0 deletions

diff --git a/hosts/ahmed/configuration.nix b/hosts/ahmed/configuration.nix
index fc1cc9c..d92c639 100644
--- a/hosts/ahmed/configuration.nix
+++ b/hosts/ahmed/configuration.nix
@@ -9,6 +9,9 @@
       ./hardware-configuration.nix
       ./ssh.nix
       ./disable-screen.nix
+      ./linus.onl.nix
+      ./notifications.linus.onl.nix
+      ./graphics.nix
     ];
 
   # Create the main user.
diff --git a/hosts/ahmed/graphics.nix b/hosts/ahmed/graphics.nix
new file mode 100644
index 0000000..e2b7a86
--- /dev/null
+++ b/hosts/ahmed/graphics.nix
@@ -0,0 +1,36 @@
+# This module configures a basic graphical environment. I use this sometimes for
+# ahmed when muhammed is being repaired.
+
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkEnableOption mkIf;
+
+  cfg = config.my.modules.graphics;
+in
+{
+  options.my.modules.graphics.enable = mkEnableOption "basic graphical environment";
+
+  config = mkIf cfg.enable {
+    services.xserver.enable = true;
+
+    # Match console keyboard layout but swap capslock and escape.
+    # TODO: Create a custom keymap with esc/capslock swap so console can use it.
+    services.xserver.layout = config.console.keyMap;
+    services.xserver.xkbOptions = "caps:swapescape";
+
+    # Enable touchpad support.
+    services.xserver.libinput.enable = true;
+
+    services.xserver.windowManager.dwm.enable = true;
+
+    # Enable sound.
+    sound.enable = true;
+    hardware.pulseaudio.enable = true;
+
+    environment.systemPackages = with pkgs; [
+      st    # suckless terminal - dwm is pretty sucky without this
+      dmenu # application launcher
+    ];
+  };
+}
diff --git a/hosts/ahmed/linus.onl.nix b/hosts/ahmed/linus.onl.nix
new file mode 100644
index 0000000..617865c
--- /dev/null
+++ b/hosts/ahmed/linus.onl.nix
@@ -0,0 +1,98 @@
+{ pkgs, lib, config, ... }:
+
+let
+  inherit (lib) mkEnableOption mkOption types mkIf optional;
+
+  domain = "linus.onl";
+
+  cfg = config.my.modules."${domain}";
+in
+{
+  options.my.modules."${domain}" = {
+    enable = mkEnableOption "${domain} static site";
+
+    useACME = mkEnableOption "built-in HTTPS stuff";
+  };
+
+  config = mkIf cfg.enable {
+    # Create a user to run the build script under.
+    users.users."${domain}-builder" = {
+      description = "builds ${domain}";
+      group = "${domain}-builder";
+      isSystemUser = true;
+    };
+    users.groups."${domain}-builder" = { };
+
+    # Create the output directory.
+    system.activationScripts."${domain}-create-www" = lib.stringAfter [ "var" ] ''
+      mkdir -p /var/www/${domain}
+      chown ${domain}-builder /var/www/${domain}
+      chgrp ${domain}-builder /var/www/${domain}
+      chmod 0755 /var/www/${domain}
+    '';
+
+    # Create a systemd service which rebuild the site regularly.
+    #
+    # This can't be done using Nix because the site relies on the git build and
+    # there are some inherent difficulties with including .git/ in the
+    # inputSource for derivations.
+    #
+    # See: https://github.com/NixOS/nix/issues/6900
+    # See: https://github.com/NixOS/nixpkgs/issues/8567
+    #
+    # TODO: Integrate rebuilding with GitHub webhooks to rebuild on push.
+    systemd.services."${domain}-source" = {
+      description = "generate https://${domain} source";
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = "${domain}-builder";
+        Group = "${domain}-builder";
+      };
+      startAt = "*-*-* *:00/5:00";
+
+      path = with pkgs; [
+        git
+        rsync
+        coreutils-full
+        tcl-8_5
+        gnumake
+      ];
+      environment.TCLLIBPATH = "$TCLLIBPATH ${pkgs.tcl-cmark}/lib/tclcmark1.0";
+      script = ''
+        set -ex
+        tmpdir="$(mktemp -d -t linus.onl-source.XXXXXXXXXXXX)"
+        cd "$tmpdir"
+        trap 'rm -rf $tmpdir' EXIT
+        # TODO: Only do minimal possible cloning
+        git clone https://github.com/linnnus/${domain} .
+        make _build
+        rsync --archive --delete _build/ /var/www/${domain}
+      '';
+
+      # TODO: Harden service
+
+      # Network must be online for us to check.
+      after = [ "network-online.target" ];
+      requires = [ "network-online.target" ];
+
+      # We must generate some files for NGINX to serve, so this should be run
+      # before NGINX.
+      before = [ "nginx.service" ];
+      wantedBy = [ "nginx.service" ];
+    };
+
+    # Register domain name with ddns.
+    services.cloudflare-dyndns.domains = [ domain ];
+
+    # Register virtual host.
+    services.nginx = {
+      virtualHosts."${domain}" = {
+        # NOTE: 'forceSSL' will cause an infite loop, if the cloudflare proxy does NOT connect over HTTPS.
+        enableACME = cfg.useACME;
+        forceSSL = cfg.useACME;
+        root = "/var/www/${domain}";
+      };
+    };
+  };
+}
diff --git a/hosts/ahmed/notifications.linus.onl.nix b/hosts/ahmed/notifications.linus.onl.nix
new file mode 100644
index 0000000..443853f
--- /dev/null
+++ b/hosts/ahmed/notifications.linus.onl.nix
@@ -0,0 +1,42 @@
+{ pkgs, lib, config, ... }:
+
+let
+  inherit (lib) mkEnableOption mkOption types mkIf optional;
+
+  domain = "notifications.linus.onl";
+
+  # TODO: Make option internal-port.
+  internal-port = 13082;
+
+  cfg = config.my.modules."notifications.linus.onl";
+in
+{
+  options.my.modules."notifications.linus.onl" = {
+    enable = mkEnableOption "notifications.linus.onl static site";
+
+    useACME = mkEnableOption "built-in HTTPS stuff";
+  };
+
+  config = mkIf cfg.enable {
+    my.services.push-notification-api = {
+      enable = true;
+      # host = "notifications.linus.onl";
+      host = "0.0.0.0";
+      port = internal-port;
+      openFirewall = false; # We're using NGINX reverse proxy.
+    };
+
+    # Register domain name.
+    services.cloudflare-dyndns.domains = [ "notifications.linus.onl" ];
+
+    # Serve the generated page using NGINX.
+    services.nginx.virtualHosts."notifications.linus.onl" = {
+      enableACME = cfg.useACME;
+      forceSSL = cfg.useACME;
+      locations."/" = {
+        recommendedProxySettings = true;
+        proxyPass = "http://127.0.0.1:${toString internal-port}";
+      };
+    };
+  };
+}