kore

feat(nixos/roles): add web

5 files changed, -6/+38

kore.json

@@ -16,7 +16,7 @@     "iris": {       "system": "x86_64-linux",       "stateVersion": "26.11",-      "roles": [],+      "roles": ["web"],       "users": ["lostduk"],       "ipv4": "82.153.138.53"     }

nixos/features/kore.nix

@@ -95,7 +95,6 @@ in {       password = "tmp";       extraGroups = [ "wheel" ]; -      # Only hosts with the home role get home folders.       createHome = hasHome;       home = if hasHome then "/home/${user}" else "/var/empty"; 

nixos/hosts/gomphrena.nix

@@ -3,16 +3,13 @@ {   imports = [ inputs.nixos-wsl.nixosModules.default ]; -  # WSL can't mount /persist at boot.   kore.impermanence.enable = false; -  # WSL can't register auditd ("Unable to set audit pid").   security = {     audit.enable = lib.mkForce false;     auditd.enable = lib.mkForce false;   }; -  # CLI only here: no mesa/LLVM (~830 MiB).   hardware.graphics.enable = lib.mkForce false;    wsl = {

nixos/hosts/iris.nix

@@ -9,7 +9,6 @@ in {     ( modulesPath + "/profiles/qemu-guest.nix" )   ]; -  # Kyun hands out a /32 with an off-subnet gateway; pin it instead of DHCP.   networking = {     useDHCP = false;     nameservers = [ "9.9.9.9" "149.112.112.112" ];

nixos/roles/web.nix

@@ -0,0 +1,37 @@+{ config, pkgs, ... }:++let+  inherit (config.networking) domain;+  admin = builtins.head config.kore.currentHost.users;+in {+  security.acme = {+    acceptTerms = true;+    defaults.email = config.kore.identities.${admin}.email;+  };++  services.nginx = {+    enable = true;++    recommendedTlsSettings = true;+    recommendedOptimisation = true;+    recommendedGzipSettings = true;+    recommendedProxySettings = true;++    virtualHosts.${domain} = {+      enableACME = true;+      forceSSL = true;++      root = pkgs.writeTextDir "index.html" ''+        <!doctype html>+        <html lang="en">+        <meta charset="utf-8">+        <title>${domain}</title>+        <p>soon</p>+        </html>+      '';+    };+  };++  networking.firewall.allowedTCPPorts = [ 80 443 ];+  environment.persistence."/persist".directories = [ "/var/lib/acme" ];+}