forked from lukas/nixos-config
609c27ce15
Source now lives in lukas/calendar-web instead of this flake, matching the website/dashboard pattern: pinix checks it out at /var/www/calendar-web, nginx serves the dist/ output directly, and a new gitpull-calendar-web webhook hook does `git pull && npm ci && npm run build` (esbuild) on push. Frontend/style-only changes no longer need a nixos-rebuild. - webhook.nix: new hook + build script - packages.nix: add nodejs (npm needed for the build script) - forgejo.nix: enable ENABLE_PUSH_CREATE_USER, needed to create the new repo by pushing to it rather than via the web UI - web.nix: nginx root points at /var/www/calendar-web/dist - README.md: document the new deploy path Still needs a Forgejo-side webhook added manually in the calendar-web repo settings (no API token available to script it): target http://127.0.0.1:9000/hooks/gitpull-calendar-web, push events on dev.
58 lines
1.7 KiB
Nix
58 lines
1.7 KiB
Nix
{ config, ... }:
|
|
|
|
{
|
|
networking.firewall.interfaces.tailscale0.allowedTCPPorts = [
|
|
5001
|
|
5002
|
|
];
|
|
|
|
services.nginx.virtualHosts."cal.${config.domain}" = {
|
|
listen = [
|
|
{
|
|
addr = config.tailnetIPs.pinix;
|
|
port = 5001;
|
|
}
|
|
];
|
|
# Kept up to date by the gitpull-calendar-web webhook, not this flake --
|
|
# see hosts/pinix/localServices/webhook.nix. Source lives in the
|
|
# separate calendar-web Forgejo repo.
|
|
root = "/var/www/calendar-web/dist";
|
|
|
|
extraConfig = ''
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'" always;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
'';
|
|
|
|
locations."/" = {
|
|
tryFiles = "$uri $uri/ /index.html";
|
|
};
|
|
|
|
locations."= /calendar.ics" = {
|
|
proxyPass = "http://${config.tailnetIPs.pinix}:5002/calendar/public/";
|
|
extraConfig = ''
|
|
limit_except GET HEAD {
|
|
deny all;
|
|
}
|
|
proxy_set_header Authorization "";
|
|
proxy_set_header Cookie "";
|
|
proxy_hide_header Set-Cookie;
|
|
'';
|
|
};
|
|
|
|
# lukas's personal calendar, exposed read-only. See the matching
|
|
# Radicale rights rule (91-lukas-calendar-public) for the UUID and its
|
|
# caveat.
|
|
locations."= /lukas.ics" = {
|
|
proxyPass = "http://${config.tailnetIPs.pinix}:5002/lukas/C6327392-6961-4753-A333-97ACE0A7CC82/";
|
|
extraConfig = ''
|
|
limit_except GET HEAD {
|
|
deny all;
|
|
}
|
|
proxy_set_header Authorization "";
|
|
proxy_set_header Cookie "";
|
|
proxy_hide_header Set-Cookie;
|
|
'';
|
|
};
|
|
};
|
|
}
|