/Unnamed-Server/default.nix at a275a8eef0b2caeb0795880f986dee8862293abe

{
  config,
  lib,
  pkgs,
  ...
}:

{
  # Use lower IO priority for Nix so my server is still responsive while getting nix-copy-closured
  nix.daemonIOSchedClass = "idle";

  nixpkgs = {
    hostPlatform = "x86_64-linux";
    # Overlays! Fixed points!
    overlays = [ (import ./overlays.nix) ];
  };

  # https://unnamed.website/posts/nixvm/
  disko.devices.disk.main = {
    imageSize = "2500M";
    type = "disk";
    device = "/dev/xvda";
    content = {
      type = "gpt";
      partitions = {
        boot = {
          size = "1M";
          type = "EF02";
        };
        ESP = {
          size = "128M";
          type = "EF00";
          content = {
            type = "filesystem";
            format = "vfat";
            mountpoint = "/boot";
            mountOptions = [ "umask=0077" ];
          };
        };
        root = {
          size = "100%";
          content = {
            type = "btrfs";
            subvolumes = {
              "/".mountpoint = "/";
              "/home" = { };
              "/nix" = { };
            };
          };
        };
      };
    };
  };

  # atime is an anti-feature and disabling it should boost perf on XVM
  fileSystems."/".options = [ "noatime" ];

  boot = {
    # XVM only has BIOS not UEFI, so no systemd-boot 😭
    loader.grub.enable = true;
    # Spooky Xen stuff
    initrd.availableKernelModules = [
      "xen-blkfront"
      "xen-netfront"
    ];
  };

  networking.hostName = "Unnamed-Server";

  # The best time zone
  time.timeZone = "UTC";

  users.users = {
    # For doing updates
    root.openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWzNs8PdQKsgSADzbub2XfrZeIrF+jK7M4VMjuRmaIt anthonywang++"
    ];
    # For normal logins
    a.openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDLPakDnAelqFTUudQB8X0T7yc/8ekV3jGqpeJb062l anthonywang"
    ];
  };

  programs.tmux.enable = true;

  services.openssh = {
    enable = true;
    settings = {
      # https://forgejo.org/docs/latest/admin/recommendations/#git-over-ssh
      # https://docs.gitlab.com/administration/git_protocol/
      # Test using GIT_TRACE_PACKET=1 git ls-remote
      AcceptEnv = [ "GIT_PROTOCOL" ];
      # Don't hack me
      PasswordAuthentication = false;
    };
  };

  # Keep the journal small
  services.journald.extraConfig = "SystemMaxUse=1G";

  # My websites
  networking.firewall.allowedTCPPorts = [
    80
    443
  ];
  services.caddy = {
    enable = true;
    package = pkgs.caddy.withPlugins {
      plugins = [
        "github.com/caddy-dns/porkbun@v0.3.1"
        "dev.mediocregopher.com/mediocre-caddy-plugins.git@v0.0.0-20250308145011-421597d7c920"
      ];
      hash = "sha256-ljrlhAbXSkg+yzIgpbG69AJm6BsAYvAUvedGTv+7Lu8=";
    };
    # Porkbun API keys
    environmentFile = "/etc/caddy/env";
    # By default only errors are logged
    logFormat = "";
    # Make Caddy log to stdout instead of to a log file
    virtualHosts = builtins.mapAttrs (k: v: v // { logFormat = ""; }) {
      "unnamed.website".extraConfig = ''
        root * /srv/http/www
        file_server
        handle_errors {
          rewrite * /{err.status_code}.html
          file_server
        }
      '';
      "git.unnamed.website".extraConfig = ''
        handle /robots.txt {
          respond "User-agent: *
Disallow: /"
        }
        # Block scrapers but allow Git clones
        @notgit {
          # Due to arcane Caddy reasons this still triggers for /robots.txt unless we explicitly ignore it here
          not path /robots.txt
          not header User-Agent git*
        }
        proof_of_work @notgit {
          # 1 year
          challenge_timeout 8760h
        }
        @assets path /cgit.css /cgit.js /cgit.png /favicon.ico
        handle @assets {
          root * ${pkgs.cgit}/cgit
          file_server
        }
        reverse_proxy unix//run/fcgiwrap-caddy.sock {
          transport fastcgi {
            env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi
          }
        }
      '';
      "*.unnamed.website".extraConfig = ''
        tls {
          dns porkbun {
            api_key {env.PORKBUN_API_KEY}
            api_secret_key {env.PORKBUN_API_SECRET_KEY}
          }
        }
        root * /srv/http/{labels.2}
        handle /cgi-bin/* {
         reverse_proxy unix//run/fcgiwrap-caddy.sock {
            transport fastcgi {
              env SCRIPT_FILENAME {http.vars.root}{path}
            }
          }
        }
        file_server
      '';
      "{$SECRET_DOMAIN}".extraConfig = ''
        root * /srv/http/{$SECRET_PATH}
        file_server
      '';
      "a.exozy.me ta180m.exozy.me".extraConfig = ''
        redir https://unnamed.website{uri} permanent
      '';
    };
  };
  # services.cgit configures cgit and fcgiwrap for nginx so it's just more straightforward to do it manually
  services.fcgiwrap.instances.caddy.socket = {
    user = "caddy";
    group = "caddy";
  };
  environment.etc.cgitrc.text =
    (lib.generators.toINIWithGlobalSection { } {
      globalSection = {
        root-title = "DO NOT L∃∀N";
        root-desc = "Department of Provably Bad Code";
        clone-prefix = "https://git.unnamed.website";
        default-page = "about";
        # The owner column is just me repeated so don't show it
        enable-index-owner = 0;
        # Idle column uses master branch
        # https://lists.zx2c4.com/pipermail/cgit/2020-August/004514.html
        # Can manually set the time using
        # touch -m --date=@$(git log -1 --format=%ct) $(git show-ref | awk '{print $2}')
        # https://ch1p.io/cgit-idle-time/
        repository-sort = "age";
        # The cache reduces load and most importantly, prevents cgit from scanning the repos on disk every time
        # To clear cache, restart fcgiwrap-caddy.service
        cache-size = 64;
        # No spam plz
        noplainemail = 1;
        # The default md2html filter uses the super slow python-markdown, so instead use MD4C
        about-filter = pkgs.writeShellScript "md2html" ''
          ${pkgs.md4c}/bin/md2html --github | sed 's/<a href="\([^/]*\)">/<a href="tree\/\1">/g'
        '';
        # Syntax highlighting
        source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
        readme = ":README.md";
        # To make repo unlisted, add hide=1 to its cgitrc
        section-from-path = 1;
      };
    })
    # scan-path MUST be last!
    # toINIWithGlobalSection sorts the options so we have to manually concatenate scan-path
    # https://wiki.archlinux.org/title/Cgit#readme_files_are_not_found,_about_tab_not_shown
    + "scan-path=/srv/git";
  systemd = {
    # The cgit cache dir must be writable by dynamic user running cgit
    # Easy solution is to use /var/tmp as the cache dir
    # I couldn't figure out how to set cache-root for cgit, so instead symlink it
    tmpfiles.rules = [ "L /var/cache/cgit - - - - /var/tmp" ];
    # Update Git mirrors
    services.update-mirrors = {
      wantedBy = [ "multi-user.target" ];
      path = with pkgs; [ git ];
      serviceConfig = {
        User = "a";
        Group = "users";
        ExecStart = pkgs.writers.writeFish "update-mirrors" ./update-mirrors.fish;
      };
    };
    timers.update-mirrors = {
      wantedBy = [ "multi-user.target" ];
      timerConfig.OnCalendar = "weekly";
    };
  };

  # Back up /srv using btrfs snapshots and btrbk
  services.btrbk = {
    sshAccess = [
      {
        key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoXy/V1rfnAcBJyRMAsqygOAeSNwxf8+oYtWNnUs3Rf btrbk@ThinkPad-X1-Yoga-Gen-6";
        roles = [
          "source"
          "info"
          "send"
        ];
      }
    ];
    instances.btrbk.settings.volume."/".subvolume = "srv";
  };
}