From c1789b9ecc07a7fff812949bb4191f8116ef5937 Mon Sep 17 00:00:00 2001
From: Phil Pluckthun <phil@kitten.sh>
Date: Mon, 6 Apr 2026 13:14:39 +0100
Subject: [PATCH] Update caddy config

---
 modules/server/caddy.nix   | 12 ++++++++++--
 modules/server/sshd.nix    |  1 +
 modules/server/tangled.nix | 21 +++++++++++++++------
 3 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/modules/server/caddy.nix b/modules/server/caddy.nix
index 916d155..7bcd7b6 100644
--- a/modules/server/caddy.nix
+++ b/modules/server/caddy.nix
@@ -55,7 +55,9 @@ let
     }
   '' else "";
 
-  knotConfig = if knotEnabled then ''
+  knotConfig = let
+    knotAddr = config.services.tangled.knot.server.listenAddr;
+  in if knotEnabled then ''
     ${cfg.tangled.hostname} {
       log
       request_body {
@@ -68,7 +70,13 @@ let
         Strict-Transport-Security "max-age=31536000"
         -Server
       }
-      reverse_proxy ${config.services.tangled.knot.server.listenAddr} {
+      handle /events {
+        reverse_proxy ${knotAddr} {
+          header_up X-Real-IP {remote_host}
+          flush_interval -1
+        }
+      }
+      reverse_proxy ${knotAddr} {
         header_up X-Real-IP {remote_host}
       }
     }
diff --git a/modules/server/sshd.nix b/modules/server/sshd.nix
index ae3060a..4ef2ee4 100644
--- a/modules/server/sshd.nix
+++ b/modules/server/sshd.nix
@@ -44,6 +44,7 @@ in {
         AllowTcpForwarding = false;
         X11Forwarding = false;
         AllowStreamLocalForwarding = false;
+        AllowUsers = [ user ];
       };
     };
   };
diff --git a/modules/server/tangled.nix b/modules/server/tangled.nix
index 7ff0983..51042a9 100644
--- a/modules/server/tangled.nix
+++ b/modules/server/tangled.nix
@@ -24,12 +24,21 @@ in helpers.linuxAttrs {
   };
 
   config = mkIf (cfg.enable && cfg.tangled.enable) {
-    services.tangled.knot = {
-      enable = true;
-      openFirewall = true;
-      server = {
-        hostname = cfg.tangled.hostname;
-        owner = cfg.tangled.owner;
+    services = {
+      tangled.knot = {
+        enable = true;
+        openFirewall = true;
+        server = {
+          hostname = cfg.tangled.hostname;
+          owner = cfg.tangled.owner;
+        };
+      };
+
+      openssh.settings = let
+        user = config.services.tangled.knot.gitUser;
+      in {
+        AllowUsers = [ user ];
+        AllowGroups = [ user ];
       };
     };
 
-- 
2.51.2