diff --git a/flake.lock b/flake.lock index 549ef16..b7f66fa 100644 --- a/flake.lock +++ b/flake.lock @@ -1,5 +1,21 @@ { "nodes": { + "actor-typeahead-src": { + "flake": false, + "locked": { + "lastModified": 1771017033, + "narHash": "sha256-Kf+FtgGcX1HIqVjZtCKNdQMeqmbk4uiOWd/W39I+Aew=", + "ref": "refs/heads/main", + "rev": "720317cf4773f73dd27b84b0fbf38ad49302f34a", + "revCount": 12, + "type": "git", + "url": "https://tangled.org/@jakelazaroff.com/actor-typeahead" + }, + "original": { + "type": "git", + "url": "https://tangled.org/@jakelazaroff.com/actor-typeahead" + } + }, "deploy-rs": { "inputs": { "flake-compat": "flake-compat", @@ -283,6 +299,69 @@ "type": "github" } }, + "htmx-src": { + "flake": false, + "locked": { + "narHash": "sha256-nm6avZuEBg67SSyyZUhjpXVNstHHgUxrtBHqJgowU08=", + "type": "file", + "url": "https://unpkg.com/htmx.org@2.0.4/dist/htmx.min.js" + }, + "original": { + "type": "file", + "url": "https://unpkg.com/htmx.org@2.0.4/dist/htmx.min.js" + } + }, + "htmx-ws-src": { + "flake": false, + "locked": { + "narHash": "sha256-2fg6KyEJoO24q0fQqbz9RMaYNPQrMwpZh29tkSqdqGY=", + "type": "file", + "url": "https://cdn.jsdelivr.net/npm/htmx-ext-ws@2.0.2" + }, + "original": { + "type": "file", + "url": "https://cdn.jsdelivr.net/npm/htmx-ext-ws@2.0.2" + } + }, + "ibm-plex-mono-src": { + "flake": false, + "locked": { + "lastModified": 1731402384, + "narHash": "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=", + "type": "tarball", + "url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip" + }, + "original": { + "type": "tarball", + "url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip" + } + }, + "inter-fonts-src": { + "flake": false, + "locked": { + "lastModified": 1731658560, + "narHash": "sha256-5vdKKvHAeZi6igrfpbOdhZlDX2/5+UvzlnCQV6DdqoQ=", + "type": "tarball", + "url": "https://github.com/rsms/inter/releases/download/v4.1/Inter-4.1.zip" + }, + "original": { + "type": "tarball", + "url": "https://github.com/rsms/inter/releases/download/v4.1/Inter-4.1.zip" + } + }, + "lucide-src": { + "flake": false, + "locked": { + "lastModified": 1754044466, + "narHash": "sha256-+exBR2OToB1iv7ZQI2S4B0lXA/QRvC9n6U99UxGpJGs=", + "type": "tarball", + "url": "https://github.com/lucide-icons/lucide/releases/download/0.536.0/lucide-icons-0.536.0.zip" + }, + "original": { + "type": "tarball", + "url": "https://github.com/lucide-icons/lucide/releases/download/0.536.0/lucide-icons-0.536.0.zip" + } + }, "mermaid-src": { "flake": false, "locked": { @@ -707,16 +786,16 @@ }, "tangled": { "inputs": { - "actor-typeahead-src": [], + "actor-typeahead-src": "actor-typeahead-src", "fenix": "fenix", "flake-compat": [], "gomod2nix": "gomod2nix", - "htmx-src": [], - "htmx-ws-src": [], - "ibm-plex-mono-src": [], + "htmx-src": "htmx-src", + "htmx-ws-src": "htmx-ws-src", + "ibm-plex-mono-src": "ibm-plex-mono-src", "indigo": [], - "inter-fonts-src": [], - "lucide-src": [], + "inter-fonts-src": "inter-fonts-src", + "lucide-src": "lucide-src", "mermaid-src": "mermaid-src", "nixpkgs": [ "nixpkgs" diff --git a/flake.nix b/flake.nix index 36db530..7e8818f 100644 --- a/flake.nix +++ b/flake.nix @@ -70,12 +70,6 @@ # We don't need any of these flake-compat.follows = ""; indigo.follows = ""; - htmx-src.follows = ""; - htmx-ws-src.follows = ""; - lucide-src.follows = ""; - inter-fonts-src.follows = ""; - actor-typeahead-src.follows = ""; - ibm-plex-mono-src.follows = ""; }; }; diff --git a/systems/focaccia/configuration.nix b/systems/focaccia/configuration.nix index 2a663ca..3cb5703 100644 --- a/systems/focaccia/configuration.nix +++ b/systems/focaccia/configuration.nix @@ -13,6 +13,7 @@ ./services/hysteria.nix ./services/knot.nix ./services/pds.nix + ./services/tangled-appview.nix ./services/ente.nix ]; diff --git a/systems/focaccia/secrets/tangled-appview.env b/systems/focaccia/secrets/tangled-appview.env new file mode 100644 index 0000000..e15ff54 --- /dev/null +++ b/systems/focaccia/secrets/tangled-appview.env @@ -0,0 +1,23 @@ +TANGLED_COOKIE_SECRET=ENC[AES256_GCM,data:gNlroc49AW+v9L3d4RP4oM8aXB1uxnIryZhUxSf4KPg=,iv:P9g7f4jrsUe+Q/ylqJaUWnpoIa950SkqI+Q4S1za0b4=,tag:U1jBiB6QpeS4LjvW2pPgHA==,type:str] +TANGLED_OAUTH_CLIENT_SECRET=ENC[AES256_GCM,data:43KWU7jz8ZCvkswBAkxmWsB4FVc4IoTEJCCFP+vb1nABe1nM8fKG14jKy9iyKhIc,iv:Uz5xm+DahGA1JBeyR49M1ELa6E1wjeDnLReSED4a2Ig=,tag:0dPa1iXlqTZ5KSZcYwwSuQ==,type:str] +TANGLED_OAUTH_CLIENT_KID=ENC[AES256_GCM,data:4RloxNSPocWHpw==,iv:IYjgEuFvjLWEdgm32UJnzsaZ8OZxOCBbCm4wK6yBcQA=,tag:f7ysi6ZuTyOG27FDbrP0JQ==,type:str] +TANGLED_RESEND_API_KEY= +TANGLED_CAMO_SHARED_SECRET= +TANGLED_AVATAR_SHARED_SECRET= +TANGLED_REDIS_PASS= +TANGLED_PDS_ADMIN_SECRET=ENC[AES256_GCM,data:7PJvIeuPl/kWAyTJbWVlZxlx85oZjfre7eOZqtoEr7c=,iv:0qz/hgrUF14YwUnpeCWm2cAG0SqluTHzgrNyg5igOPY=,tag:KLE7blp2tmatlKsmtKB3FQ==,type:str] +TANGLED_CLOUDFLARE_API_TOKEN= +TANGLED_CLOUDFLARE_ZONE_ID= +TANGLED_CLOUDFLARE_TURNSTILE_SITE_KEY= +TANGLED_CLOUDFLARE_TURNSTILE_SECRET_KEY= +TANGLED_POSTHOG_API_KEY= +TANGLED_APP_PASSWORD=ENC[AES256_GCM,data:QPzgoC8dUUhhHnKXh8kdrisAV1g=,iv:ZZ+0FSgabzmpwZKGGk+qP++3NLTrKKFRRb0k9PPjTAs=,tag:c9va5ob+P3NJuE9QcAVhRA==,type:str] +TANGLED_ALT_APP_PASSWORD= +sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpS2UvMm1ienAzOWlyMW5X\naEUrK0hRTU1UdWVWTW1ULzR4RFlsV3RsbFc4Cll1amhOb2txVmsyOWp3cVlMOFpE\nRDVFc3VvV1lOYS9CUlJSbG8xd2psc3cKLS0tIGRXWW44REI2M0Y3SUZFek5qNHZC\ndVl0ZnlaRktKcHRrNm9YdzYyNHU3eGcKFUUs1F30q2XPyZ5XKN4Xf/ZlTHmyQ8Su\nk9wP+/2VnliWrK10rqNFG3KOjsJmn0RxJXE7WnG23PguN+F3SHX0gw==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_0__map_recipient=age1lh4sn2s9gxj2s3naqdl4wpmz3uhpd3p8l0jfy6k5hu6cu34uyygsdwadd5 +sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwSmp1N1h6YkpMWEgwOWhI\namNzWG1sZUw2TWY0MjMrNERTSVNOSVNCRkZZCkNabHdTdGxNY3JMbXJzaFJkeWpG\nY2lHbmRITzlrZm5ISVY3Z1IvdXh2UEEKLS0tIFNPVUVxR3prQjJJMXJIdkk4eExz\nQmNIYi8wUGFKRDNKYmVSU3hYYndIVUUK9ZDGvFiNEYJDxnnpAGt7KBahclPSdLEl\n7PRNqXKPHS4CH9xbTTWiqvkIac7aWu4PVh/EWzqoagI+exKaTNoU5w==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_1__map_recipient=age1wtr58sze4sxjjzq9jmsq7ztkvkjakvnfzuqzn025p92htz7zsdesjpc2c8 +sops_lastmodified=2026-04-30T18:55:57Z +sops_mac=ENC[AES256_GCM,data:hzRedndtpKlB+POPYailOJ52iuYA6t3SujADujYMkNJNi/t78JxBo7qGNAwqGZc9jdAZTNf/9MB1aJEGQZ+tndRmxrFPp9bQzrQfSfkxn2xb21vNCJggoR0qAn8098c8BGTHQJNYPOMDvWKnQlpCBBNH5lm8m2+1aWAhtEAFjlo=,iv:TCWi5noJNi5rZyDMfAUrvdR69/O0uAdehGkEFC8pT9M=,tag:0ToP7TPwh3VDS+n2qDNK5Q==,type:str] +sops_unencrypted_suffix=_unencrypted +sops_version=3.12.2 diff --git a/systems/focaccia/services/knot.nix b/systems/focaccia/services/knot.nix index 23cf617..d3cb0c9 100644 --- a/systems/focaccia/services/knot.nix +++ b/systems/focaccia/services/knot.nix @@ -8,8 +8,6 @@ let in { imports = [ - - inputs.tangled.nixosModules.knot ]; diff --git a/systems/focaccia/services/pds.nix b/systems/focaccia/services/pds.nix index 177576e..8173273 100644 --- a/systems/focaccia/services/pds.nix +++ b/systems/focaccia/services/pds.nix @@ -23,7 +23,19 @@ in }; services.caddy.virtualHosts.${cfg.PDS_HOSTNAME}.extraConfig = '' - reverse_proxy :${toString cfg.PDS_PORT} + handle /oauth/* { + # HACK: For some reason the PDS only accepts cross-site, same-origin + # or none for Sec-Fetch-Site for the initial AppView -> PDS flow, + # meaning that you cannot put an AppView and a PDS under two subdomains + # in the same domain. I think that's dumb and buggy, so let's hack + # around this + request_header Sec-Fetch-Site same-origin + + reverse_proxy :${toString cfg.PDS_PORT} + } + handle { + reverse_proxy :${toString cfg.PDS_PORT} + } ''; # services.postgresql = { diff --git a/systems/focaccia/services/tangled-appview.nix b/systems/focaccia/services/tangled-appview.nix new file mode 100644 index 0000000..bb22e31 --- /dev/null +++ b/systems/focaccia/services/tangled-appview.nix @@ -0,0 +1,30 @@ +{ + inputs, + config, + ... +}: +let + cfg = config.services.tangled.appview; +in +{ + imports = [ + inputs.tangled.nixosModules.appview + ]; + + sops.secrets.tangled-appview = { + # Has to be a separate file since it's a .env file + sopsFile = ../secrets/tangled-appview.env; + format = "dotenv"; + }; + + services.tangled.appview = { + enable = true; + appviewHost = "git.pluie.me"; + appviewName = "pluie's code"; + pds.host = "pds.pluie.me"; + environmentFile = config.sops.secrets.tangled-appview.path; + }; + services.caddy.virtualHosts.${cfg.appviewHost}.extraConfig = '' + reverse_proxy :${toString cfg.port} + ''; +}