/Unnamed-Server/default.nix at 18258b33dde5253d0952feb0fa46db89d99a539f

{
  config,
  lib,
  pkgs,
  ...
}:

let
  legit-web = pkgs.legit-web.overrideAttrs (old: {
    # Technically upstream is https://git.pocka.jp/legit.git but using GitHub is maybe more reliable?
    # Since if GitHub is down nixpkgs itself breaks
    src = pkgs.fetchFromGitHub {
      owner = "pocka";
      repo = "legit";
      rev = "6248d4ed1879658aeeb66541a95ee677ef3567a8"; # TODO: Use v1.0 once it's released
      hash = "sha256-Cfg5wny0dBSBfhXkgjtjCOGMCTjcpT7Lw1GGxr6Qrew=";
    };
    vendorHash = "sha256-qSnRQIuHnUQit21232SsMY0LQVvcy0PqBPQVPjsNJWA=";
    nativeCheckInputs = [ pkgs.git ];
    postInstall = "";
  });
  # Don't use services.legit.settings because of its rigid schema
  legit-yaml = (pkgs.formats.yaml { }).generate "legit.yaml" {
    meta = {
      title = "Typeclass instance problem is stuck";
      description = "It is often due to incompetence";
      syntaxHighlight = true;
    };
    repo = {
      mainBranch = [
        "main"
        "master"
      ];
      readme = [ "README.md" ];
      scanPath = "/srv/git";
    };
    server = {
      name = "git.unnamed.website";
      host = "localhost";
      port = 5555;
    };
    ui.footer.poweredBy = true;
  };
in
{
  # Use lower IO priority for Nix so my server is still responsive while GCing
  nix.daemonIOSchedClass = "idle";

  nixpkgs.hostPlatform = "x86_64-linux";

  # https://unnamed.website/posts/nixvm/
  disko.devices.disk.main = {
    imageSize = "2000M";
    type = "disk";
    device = "/dev/xvda";
    content = {
      type = "gpt";
      partitions = {
        boot = {
          size = "1M";
          type = "EF02";
        };
        root = {
          size = "100%";
          content = {
            type = "btrfs";
            subvolumes = {
              "/".mountpoint = "/";
              "/home" = { };
              "/nix" = { };
            };
          };
        };
      };
    };
  };

  # atime is an anti-feature and disabling it should boost perf on XVM
  fileSystems."/".options = [ "noatime" ];

  boot = {
    # XVM only has BIOS not UEFI, so no systemd-boot 😭
    loader.grub.enable = true;
    # Spooky Xen stuff
    initrd.availableKernelModules = [
      "xen-blkfront"
      "xen-netfront"
    ];
  };

  networking.hostName = "Unnamed-Server";

  # The best time zone
  time.timeZone = "UTC";

  users.users = {
    # For doing updates
    root.openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWzNs8PdQKsgSADzbub2XfrZeIrF+jK7M4VMjuRmaIt anthonywang++"
    ];
    # For normal logins
    a.openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDLPakDnAelqFTUudQB8X0T7yc/8ekV3jGqpeJb062l anthonywang"
    ];
  };

  # It's possible to nuke Python by using fishMinimal and gitMinimal but eh it doesn't save that much space and is a hassle
  programs.tmux.enable = true;

  services.openssh = {
    enable = true;
    settings = {
      # https://forgejo.org/docs/latest/admin/recommendations/#git-over-ssh
      # https://docs.gitlab.com/administration/git_protocol/
      # Test using GIT_TRACE_PACKET=1 git ls-remote
      AcceptEnv = [ "GIT_PROTOCOL" ];
      # Don't hack me
      PasswordAuthentication = false;
    };
  };

  # Keep the journal small
  services.journald.extraConfig = "SystemMaxUse=1G";

  # My websites
  services.caddy = {
    enable = true;
    openFirewall = true;
    package = pkgs.caddy.withPlugins {
      plugins = [
        "github.com/caddy-dns/porkbun@v0.3.1"
        "dev.mediocregopher.com/mediocre-caddy-plugins.git@v0.0.0-20250308145011-421597d7c920"
      ];
      hash = "sha256-BMUIO9oH6gkOBgtVrkcdA6l5X+OYMvZvl6EznZ2YTBU=";
    };
    # Porkbun API keys
    environmentFile = "/etc/caddy/env";
    # By default only errors are logged
    logFormat = "";
    # Make Caddy log to stdout instead of to a log file
    virtualHosts = builtins.mapAttrs (k: v: v // { logFormat = ""; }) {
      "unnamed.website".extraConfig = ''
        root * /srv/http/www
        file_server
        handle_errors {
          rewrite * /{err.status_code}.html
          file_server
        }
      '';
      "git.unnamed.website".extraConfig = ''
        handle /robots.txt {
          respond "User-agent: *
        Disallow: /"
        }
        # Block scrapers but allow Git clones
        @notgit {
          # Due to arcane Caddy reasons this still triggers for /robots.txt unless we explicitly ignore it here
          not path /robots.txt
          not header User-Agent git*
        }
        proof_of_work @notgit {
          # 1 year
          challenge_timeout 8760h
        }
        reverse_proxy localhost:5555
      '';
      "*.unnamed.website".extraConfig = ''
        tls {
          dns porkbun {
            api_key {env.PORKBUN_API_KEY}
            api_secret_key {env.PORKBUN_API_SECRET_KEY}
          }
        }
        root * /srv/http/{labels.2}
        file_server
      '';
      "{$SECRET_DOMAIN}".extraConfig = ''
        root * /srv/http/{$SECRET_PATH}
        file_server
      '';
      "a.exozy.me ta180m.exozy.me".extraConfig = ''
        redir https://unnamed.website{uri} permanent
      '';
    };
  };

  # Git server
  services.legit.enable = true;
  systemd = {
    services.legit = {
      # Fix error when git cloning
      path = [ pkgs.git ];
      # Use custom config file
      serviceConfig.ExecStart = lib.mkForce "${legit-web}/bin/legit -config ${legit-yaml}";
    };
    # Update Git mirrors
    services.update-mirrors = {
      wantedBy = [ "multi-user.target" ];
      path = [ pkgs.git ];
      serviceConfig = {
        User = "a";
        Group = "users";
        ExecStart = pkgs.writers.writeFish "update-mirrors" ./update-mirrors.fish;
      };
    };
    timers.update-mirrors = {
      wantedBy = [ "multi-user.target" ];
      timerConfig.OnCalendar = "weekly";
    };
  };

  # Back up /srv using btrfs snapshots and btrbk
  services.btrbk = {
    sshAccess = [
      {
        key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoXy/V1rfnAcBJyRMAsqygOAeSNwxf8+oYtWNnUs3Rf btrbk@ThinkPad-X1-Yoga-Gen-6";
        roles = [
          "source"
          "info"
          "send"
        ];
      }
    ];
    instances.btrbk.settings.volume."/".subvolume = "srv";
  };
}