draft: partially getting authentik to work

needs manual systemctl start once booted for now its started at auth.tuxcord.test
nixos/users: port tuxcord.net motd
2026-05-05 00:02:48 +02:00 · 2026-05-04 20:50:25 +02:00 · 2026-05-04 12:36:34 -04:00 · 2026-05-04 01:36:59 -04:00 · 2026-05-04 01:31:27 -04:00 · 2026-05-04 01:31:27 -04:00
20 changed files with 469 additions and 92 deletions
@@ -0,0 +1,20 @@
+age-encryption.org/v1
+-> ssh-ed25519 Wl2fDA 7PqbYWjorqzuPIDZgOZGIMzZa/P89aGzvORfMAeePRU
+J+gesdnj8VwqJSfD1ohDTSp7nBXdM4nEEB5/7aA1PMc
+-> ssh-ed25519 zNC8SA z47u0fUlGVYiQr4/S0lLh6WEj7gyedjWsq4fUk5Z1CY
+6qR4zdA1gQqpAcm5Q5AZJgn3ZnafXL4OeHfU4WJae40
+-> ssh-ed25519 EiAAKw 8mPi6HaHW+oFZHZ0Y2fJ2XISgarW3i/yLKD2QJleFGs
+Mch7D28T9eiJm8hmSuI7Wm/rjjT+EzzER9vQ7T6rA3k
+-> ssh-rsa eFi+Zw
+d3mwAM+p4yz/UK5g4+0WyeOPyEVHQEyzGSB+pPDf6IIXxGbh613h1WD5j3AQQXdH
+178Es9PhkiZcy0Y0IsQt4dyqDzuqMMwzLLvLKgsfliFsPBcdo93V5r9rWtFi3+9S
+jAfhsFzVUj3KhuBY+xsgBtHpLe5CVV52NnEzXkoJw1wbdunNi62QZvyyC+0NixFV
+HW1lxan6g6XXPrXWWrLbZWvpuqvPV6DoLsofzkMm0nd1DhkeHRU1WU8ucnPaETrJ
+E5G3YrlfhftwRzp/QzeoSFREmdAJca7ycIJaJuG8QIszTZLOOQBUAxg7sonATGUc
+Zutg1lJEfaQSe8oG1iMrJlshGspuSmBc1Ki4iQJjhQnYzvkV+Th9trG3QGq5ur9O
+RYCxqjMMzbp6kR2GdJorSM7P5fpzt0sSv2mxd+nQpMoyvOVfbBjmEbiuWrKSlIl0
+tXYrI6723mRNsbtmodUdDttaDFnr2r0MWbpHPn/K6y422GEoAiKE96Z7Pcxo2+Ml
+
+--- ILGiZiEBKY+7nych4vWMVWgiFNhF3eP7mtCvJ/JImxM
+jFÍ%aë;¸8Œõl�Ë�Ô é‚YÊ×ö…›�´töÐ:Â÷ì®û¦#í õÞ(¹ðÂV°;ê[Ç`üØë:tžS#ˆ
+@²ãÒk7²àFž¿ÓEn®†!ÉlÈ¥ÛšŽÃ�7°!•Òï‡êY3:+mzÕÒÈö
@@ -10,6 +10,7 @@ let
 in
 {
  "ntfy.age".publicKeys = [ tuxcord-ca ] ++ adminSSHKeys;
+  "authentik.age".publicKeys = [ tuxcord-ca ] ++ adminSSHKeys;

  # tsig-keygen etc.sub.domain.tld.
  "dns/tuxcord.net/tuxcord.net.key.age".publicKeys = [ tuxcord-ca ] ++ adminSSHKeys;
@@ -21,5 +22,5 @@ in
  map (user: {
    name = "dns/tuxcord.net/${user.name}.tuxcord.net.key.age";
    value.publicKeys = [ tuxcord-ca ] ++ getSSHKeys user.name;
-  }) (builtins.filter (user: user.value.options.ddns or false) (attrsToList users))
+  }) (builtins.filter (user: user.value.ddns or false) (attrsToList users))
 )
@@ -23,6 +23,67 @@
        "type": "github"
      }
    },
+    "authentik-go": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1771856219,
+        "narHash": "sha256-zTEmvxe+BpfWYvAl675PnhXCH4jV4GUTFb1MrQ1Eyno=",
+        "owner": "goauthentik",
+        "repo": "client-go",
+        "rev": "4c1444ee54d945fbcc5ae107b4f191ca0352023d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "goauthentik",
+        "repo": "client-go",
+        "type": "github"
+      }
+    },
+    "authentik-nix": {
+      "inputs": {
+        "authentik-go": "authentik-go",
+        "authentik-src": "authentik-src",
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "flake-utils": "flake-utils",
+        "napalm": "napalm",
+        "nixpkgs": "nixpkgs",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "systems": "systems_2",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1776085803,
+        "narHash": "sha256-JvvWVbXJYSY8qOReMbAOD4lxcN2cjKV6lg/jLz8CEuY=",
+        "owner": "nix-community",
+        "repo": "authentik-nix",
+        "rev": "4370b561c8bafb59773ce3a518506bcf1161dbdb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "authentik-nix",
+        "type": "github"
+      }
+    },
+    "authentik-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1775573258,
+        "narHash": "sha256-Xq7JGI/8ppIydIuWd9KRJKUrh7UpeniwvZ4NAtXbYJ4=",
+        "owner": "goauthentik",
+        "repo": "authentik",
+        "rev": "5249546862986202b901c2afd860992ec48c6ef6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "goauthentik",
+        "ref": "version/2026.2.2",
+        "repo": "authentik",
+        "type": "github"
+      }
+    },
    "darwin": {
      "inputs": {
        "nixpkgs": [
@@ -46,6 +107,7 @@
      }
    },
    "flake-compat": {
+      "flake": false,
      "locked": {
        "lastModified": 1767039857,
        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
@@ -61,6 +123,21 @@
      }
    },
    "flake-compat_2": {
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
      "flake": false,
      "locked": {
        "lastModified": 1767039857,
@@ -80,6 +157,24 @@
      "inputs": {
        "nixpkgs-lib": "nixpkgs-lib"
      },
+      "locked": {
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_2"
+      },
      "locked": {
        "lastModified": 1777678872,
        "narHash": "sha256-EPIFsulyon7Z1vLQq5Fk64GR8L7cQsT+IPhcsukVbgk=",
@@ -94,6 +189,27 @@
        "type": "github"
      }
    },
+    "flake-utils": {
+      "inputs": {
+        "systems": [
+          "authentik-nix",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "git-hooks-nix": {
      "inputs": {
        "flake-compat": [
@@ -188,9 +304,35 @@
        "type": "github"
      }
    },
+    "napalm": {
+      "inputs": {
+        "flake-utils": [
+          "authentik-nix",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "authentik-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1725806412,
+        "narHash": "sha256-lGZjkjds0p924QEhm/r0BhAxbHBJE1xMOldB/HmQH04=",
+        "owner": "willibutz",
+        "repo": "napalm",
+        "rev": "b492440d9e64ae20736d3bec5c7715ffcbde83f5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "willibutz",
+        "ref": "avoid-foldl-stack-overflow",
+        "repo": "napalm",
+        "type": "github"
+      }
+    },
    "nix-alien": {
      "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
        "nix-index-database": [
          "nix-index-database"
        ],
@@ -234,12 +376,12 @@
    },
    "nix-super": {
      "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
        "flake-parts": [
          "flake-parts"
        ],
        "git-hooks-nix": "git-hooks-nix",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
        "nixpkgs-23-11": "nixpkgs-23-11",
        "nixpkgs-regression": "nixpkgs-regression"
      },
@@ -259,15 +401,18 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1771903837,
-        "narHash": "sha256-jEA8WggGKtMFeNeCKq3NK8cLEjJmG6/RLUElYYbBZ0E=",
-        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11/nixos-25.11.6495.e764fc9a4058/nixexprs.tar.xz"
+        "lastModified": 1771848320,
+        "narHash": "sha256-0MAd+0mun3K/Ns8JATeHT1sX28faLII5hVLq0L3BdZU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2fc6539b481e1d2569f25f8799236694180c0993",
+        "type": "github"
      },
      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz"
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
      }
    },
    "nixpkgs-23-11": {
@@ -287,6 +432,21 @@
      }
    },
    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1769909678,
+        "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "72716169fe93074c333e8d0173151350670b824c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_2": {
      "locked": {
        "lastModified": 1777168982,
        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
@@ -318,6 +478,19 @@
      }
    },
    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1771903837,
+        "narHash": "sha256-jEA8WggGKtMFeNeCKq3NK8cLEjJmG6/RLUElYYbBZ0E=",
+        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/25.11/nixos-25.11.6495.e764fc9a4058/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_3": {
      "locked": {
        "lastModified": 1777428379,
        "narHash": "sha256-ypxFOeDz+CqADEQNL72haqGjvZQdBR5Vc7pyx2JDttI=",
@@ -333,15 +506,66 @@
        "type": "github"
      }
    },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "authentik-nix",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "authentik-nix",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "authentik-nix",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1771423342,
+        "narHash": "sha256-7uXPiWB0YQ4HNaAqRvVndYL34FEp1ZTwVQHgZmyMtC8=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "04e9c186e01f0830dad3739088070e4c551191a4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "authentik-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1771518446,
+        "narHash": "sha256-nFJSfD89vWTu92KyuJWDoTQJuoDuddkJV3TlOl1cOic=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "eb204c6b3335698dec6c7fc1da0ebc3c6df05937",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
        "agenix": "agenix",
-        "flake-parts": "flake-parts",
+        "authentik-nix": "authentik-nix",
+        "flake-parts": "flake-parts_2",
        "impermanence": "impermanence",
        "nix-alien": "nix-alien",
        "nix-index-database": "nix-index-database",
        "nix-super": "nix-super",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_3"
      }
    },
    "systems": {
@@ -358,6 +582,46 @@
        "repo": "default",
        "type": "github"
      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1689347949,
+        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "owner": "nix-systems",
+        "repo": "default-linux",
+        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default-linux",
+        "type": "github"
+      }
+    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "authentik-nix",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "authentik-nix",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772187362,
+        "narHash": "sha256-gCojeIlQ/rfWMe3adif3akyHsT95wiMkLURpxTeqmPc=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "abe65de114300de41614002fe9dce2152ac2ac23",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
    }
  },
  "root": "root",
@@ -31,6 +31,13 @@
      url = "github:privatevoid-net/nix-super";
      inputs.flake-parts.follows = "flake-parts";
    };
+
+    authentik-nix = {
+      url = "github:nix-community/authentik-nix";
+
+      # inputs.nixpkgs.follows = "nixpkgs"
+      # inputs.flake-parts.follows = "flake-parts"
+    };
  };

  outputs =
@@ -1,21 +1,24 @@
 rec {
-  users = import ./users.nix;
+  toList = x: if builtins.isList x then x else [ x ];

-  adminSSHKeys = builtins.concatLists (
-    map (user: getSSHKeys user.name) (
-      builtins.filter (user: user.value.options.admin or false) (attrsToList users)
-    )
-  );
+  nameValuePair = name: value: { inherit name value; };
+
+  mapAttrsToList = f: attrs: builtins.attrValues (builtins.mapAttrs f attrs);

  attrsToList = mapAttrsToList nameValuePair;
-  mapAttrsToList = f: attrs: builtins.attrValues (builtins.mapAttrs f attrs);
-  nameValuePair = name: value: { inherit name value; };
-  toList = x: if builtins.isList x then x else [ x ];

  getSSHKeys =
    username:
    if (builtins.hasAttr "ssh" users.${username}) then
      toList users.${username}.ssh
    else
-      builtins.warn "user ${username} declared without ssh key" [ ];
+      builtins.warn "user ${username} declared without ssh keys" [ ];
+
+  users = import ./users.nix;
+
+  adminSSHKeys = builtins.concatLists (
+    map (user: getSSHKeys user.name) (
+      builtins.filter (user: user.value.admin or false) (attrsToList users)
+    )
+  );
 }
@@ -1,23 +1,19 @@
 {
  error = {
    ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDzdpxex2GlFVf5G2qsh3Ixa/XCMjnbq4JSTmAev7WYJ error.nointernet@gmail.com";
-    options = {
    admin = true;
    ddns = true;
  };
-  };

  javalsai = {
    ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDFjavnLqxIzFLIUpUWDOwhlYeoII4Qk1/9e0yWWxD/P";
-    options = {
    admin = true;
    ddns = true;
  };
-  };

  max = {
    ssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDxVfJhzPDZ108UjB3Vj/akzlzYn27kyAw29AuYAr7gvG5vrqhLUYYmK8t+ZVWVpc1g6cK7OF1oUn2E5Qfmy6wqyZQXftAZ4OcRS0MB71W1bAcRq3rGe6KQDm8RSEeygX+zO+2Z6zQmVWgPr/I+JFQZ8wiWdP8X8djqTRdhqUD+SR3ZgTcnY3aLmeB/I56rcZQ3lKIeg/pEsyQ8weptlV0rTWamna6Z7Nw48VwWNSI+6EqfW2/4/edm0Ue8jMNqNZ0yx+kHJbudPgZgSR1SiR2rqlEEUaiQJQQV3VdY4DhGm7143ZSKUxyKlfTuQ7qR1zSIg6f5V71A37ik9YiSbBlOZO86swR4qHESoMNf608IuqRt2NdALHwozFPUCu16qnhu5JTk8twSAzrAhOk5zWQj1LYMoQEBhcFSmwir/1gE71NSjYtqXGVAdfkVmZ4uqG5+a1D7H3VXWOqu/j839M045O1ZBY6X3lKDsEJ1Z1+LCl/NojWnvPtJUHYI6+SdQ6k=";
-    options.admin = true;
+    admin = true;
  };

  vectorum = {
@@ -18,6 +18,7 @@ in
    agenix.nixosModules.default
    impermanence.nixosModules.default
    nix-index-database.nixosModules.nix-index
+    authentik-nix.nixosModules.default

    ./hardware.nix
    ./impermanence.nix
@@ -99,22 +100,15 @@ in

    extraHosts =
      let
-        subdomains = [
-          ""
-          ".git"
-        ];
+        subdomains = [ "git" "auth" ];
+
+        inherit (config.networking) fqdn;
+        hosts = [ fqdn ] ++ map (sub: "${sub}.${fqdn}") subdomains;
      in
-      builtins.foldl' (
-        hosts-acc: domain-prefix:
-        let
-          host = "${domain-prefix}${config.networking.fqdn}";
-        in
-        hosts-acc
-        + ''
+      lib.concatMapStrings (host: ''
        127.0.0.1 ${host}
        ::1 ${host}
-        ''
-      ) "" subdomains;
+      '') hosts;
  };

  virtualisation.podman.enable = true;
@@ -15,7 +15,10 @@
      "xhci_pci"
    ];

-    kernelModules = [ "kvm-intel" ];
+    kernelModules = [
+      "kvm-amd"
+      "kvm-intel"
+    ];
  };

  hardware = {
@@ -1,11 +1,14 @@
 {
-  acme = {
-    enable = true;
-    rfc2136.nameserver = "tuxcord.net";
-  };
+  imports = [
+    ./storage.nix
+  ];

-  dns.enable = true;
  networking.fqdn = "nix.tuxcord.net";

+  acme.rfc2136.nameserver = "tuxcord.net";
+  dns.enable = true;
+
+  services.getty.autologinUser = "root";
+
  time.timeZone = "Europe/Madrid";
 }
@@ -0,0 +1,6 @@
+{
+  fileSystems."/" = {
+    device = "/dev/vda";
+    fsType = "ext4";
+  };
+}
@@ -32,6 +32,7 @@
        device = "/dev/xvda2";
        fsType = "btrfs";
        options = [ "subvol=@persist" ] ++ defaultOptions;
+        neededForBoot = true;
      };
    };
 }
@@ -1,6 +1,12 @@
 {
+  imports = [
+    ./storage.nix
+  ];
+
+  networking.fqdn = "tuxcord.test";
+
  acme.enable = false;
  dns.enable = true;

-  networking.fqdn = "tuxcord.test";
+  services.getty.autologinUser = "root";
 }
@@ -0,0 +1,6 @@
+{
+  fileSystems."/" = {
+    device = "/dev/vda";
+    fsType = "ext4";
+  };
+}
@@ -55,8 +55,6 @@
    };
  };

-  fileSystems."/persist".neededForBoot = true;
-
  environment.persistence."/persist" = {
    enable = true;
    hideMounts = true;
@@ -0,0 +1,17 @@
+{ config, self, ... }:
+let
+  inherit (config.networking) fqdn;
+in
+{
+  age.secrets.authentik.file = "${self}/agenix/authentik.age";
+
+  services.authentik = {
+    enable = true;
+    environmentFile = config.age.secrets.authentik.path; # just trust, this specifies port 3001
+    # nginx = {
+    #   enable = true;
+    #   enableACME = true;
+    #   host = "auth.${fqdn}";
+    # };
+  };
+}
@@ -1,6 +1,7 @@
 {
  imports = [
    ./acme.nix
+    ./authentik.nix
    ./dns.nix
    ./fail2ban.nix
    ./gitea.nix
@@ -1,21 +1,46 @@
-{ config, ... }:
+{ config, self, ... }:
 let
  inherit (config.networking) fqdn;

  mkVhost =
-    attrs:
+    attrs: locations:
    let
      acmeEnabled = config.acme.enable;
    in
    {
      forceSSL = acmeEnabled;
      useACMEHost = if acmeEnabled then fqdn else null;
+
+      locations = {
+        "= /robots.txt" = {
+          alias = disallowedRobotsTxt;
+        };
+      }
+      // locations;
    }
    // attrs;

  mkProxy = port: {
    proxyPass = "http://127.0.0.1:${toString port}/";
+
+    extraConfig = ''
+      proxy_buffering off;
+      proxy_request_buffering off;
+    '';
  };
+
+  mkSsi = webRoot: {
+    root = webRoot;
+
+    extraConfig = ''
+      ssi on;
+    '';
+  };
+
+  disallowedRobotsTxt = builtins.toFile "robots.txt" ''
+    User-agent: *
+    Disallow: /
+  '';
 in
 {
  services.nginx = {
@@ -27,14 +52,18 @@ in
    recommendedGzipSettings = true;
    recommendedOptimisation = true;

-    # services.nginx.virtualHosts."${fqdn}" = {
-    #   addSSL = true;
-    #   root = "/var/www/myhost.org";
-    #   default = true;
-    # };
+    virtualHosts = {
+      "${fqdn}" = mkVhost { default = true; } {
+        "/" = mkSsi "${self.pins.website}/web-root";
+      };

-    virtualHosts."git.${fqdn}" = mkVhost {
-      locations."/" = mkProxy config.services.gitea.settings.server.HTTP_PORT;
+      "git.${fqdn}" = mkVhost { } {
+        "/" = mkProxy config.services.gitea.settings.server.HTTP_PORT;
+      };
+
+      "auth.${fqdn}" = mkVhost { } {
+        "/" = mkProxy 3001;
+      };
    };
  };

@@ -4,6 +4,7 @@

    settings = {
      ClientAliveInterval = 300;
+      X11Forwarding = true;

      KbdInteractiveAuthentication = false;
      PasswordAuthentication = false;
@@ -11,12 +11,7 @@ let
    "wheel"
  ];

-  mkUser =
-    name: uid: options:
-    let
-      admin = options.admin or false;
-    in
-    {
+  mkUser = name: uid: admin: {
    users.users.${name} = {
      inherit uid;
      isNormalUser = true;
@@ -39,7 +34,7 @@ lib.recursiveUpdate
  (builtins.foldl'
    (attrs: user: {
      options = lib.recursiveUpdate attrs.options (
-        mkUser user.name attrs.uid (user.value.options or { })
+        mkUser user.name attrs.uid (user.value.admin or false)
      );
      uid = attrs.uid + 1;
    })
@@ -50,8 +45,21 @@ lib.recursiveUpdate
    (lib.attrsToList users)
  ).options
  {
-    users.users.root = {
+    users = {
+      motd = ''
+                  __                                          __                      __
+        ---------/\ \__                                      /\ \                    /\ \__
+        ---------\ \ ,_\  __  __  __  _   ___    ___   _ __  \_\ \        ___      __\ \ ,_\
+        ----------\ \ \/ /\ \/\ \/\ \/'\ /'___\ / __`\/\`'__\/'_` \      /'_ `\  /'__`\ \ \/
+        -----------\ \ \_\ \ \_\ \/>  <//\ \__//\ \L\ \ \ \//\ \L\ \  __/\ \/\ \/\  __/\ \ \_
+        ------------\ \__\\ \____//\_/\_\ \____\ \____/\ \_\\ \___,_\/\_\ \_\ \_\ \____\\ \__\
+        -------------\/__/ \/___/ \//\/_/\/____/\/___/  \/_/ \/__,_ /\/_/\/_/\/_/\/____/ \/__/
+                                                    A friendly Linux community - est. July 2023
+      '';
+
+      users.root = {
        initialPassword = "tuxcord";
        openssh.authorizedKeys.keys = self.lib.adminSSHKeys;
      };
+    };
  }
@@ -1,4 +1,17 @@
 {
-  "pins": {},
+  "pins": {
+    "website": {
+      "type": "Git",
+      "repository": {
+        "type": "Git",
+        "url": "https://git.javalsai.tuxcord.net/tuxcord/website.git"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "b18dd7b863644debb0a843a5b21bb490bfe7d048",
+      "url": null,
+      "hash": "18czfxaldy0zhjprdsqzxnzj3p9qlc4canwigr13iw2wisi4ww5y"
+    }
+  },
  "version": 5
 }
Author	SHA1	Message	Date
javalsai	833a21b1c1	draft: partially getting authentik to work Check / Nix flake (push) Failing after 8s Details Lint / Nix expressions (push) Failing after 9s Details needs manual systemctl start once booted for now its started at auth.tuxcord.test	2026-05-05 00:02:48 +02:00
javalsai	82c76dc390	nixos/users: port tuxcord.net motd Check / Nix flake (push) Failing after 8s Details Lint / Nix expressions (push) Failing after 11s Details	2026-05-04 20:50:25 +02:00
javalsai	edf7aab2f0	nixos/services: serve a strict robots.txt everywhere Check / Nix flake (push) Failing after 8s Details Lint / Nix expressions (push) Failing after 9s Details	2026-05-04 12:36:34 -04:00
ErrorNoInternet	760c5c8284	nixos/hardware: add kvm-amd module Check / Nix flake (push) Failing after 10s Details Lint / Nix expressions (push) Failing after 10s Details From running the virtual machine on an AMD system.	2026-05-04 01:36:59 -04:00
ErrorNoInternet	3a5d5d27f4	nixos/networking: fix extraHosts generation	2026-05-04 01:31:27 -04:00
ErrorNoInternet	015bbc3d66	npins: update website	2026-05-04 01:31:27 -04:00
ErrorNoInternet	dc374e8c04	nixos/hosts: declare fileSystems for testing hosts	2026-05-04 01:31:27 -04:00
ErrorNoInternet	a708c04a9a	nixos/services/openssh: enable X11 forwarding	2026-05-04 01:31:27 -04:00
javalsai	a2534a3dab	nixos/hosts: enable autologin for testing hosts	2026-05-04 01:31:15 -04:00
javalsai	b78c41a5f7	nixos/services: add default website on nginx	2026-05-04 01:27:11 -04:00
javalsai	e1f2dc3161	nixos/services: disable nginx proxy buffering	2026-05-04 01:27:11 -04:00
ErrorNoInternet	f1c5f038ec	nixos/impermanence: remove ssh host key persistence The SSH host key files are already defined in the OpenSSH module, so there is no need to persist them with impermanence.nix.	2026-05-04 01:27:10 -04:00
ErrorNoInternet	ae0d4f5958	shells: remove neovim Some users may be using self-contained Neovim executables.	2026-05-04 01:27:10 -04:00
ErrorNoInternet	ded0374c57	agenix: import initial user dns keys	2026-05-04 01:27:10 -04:00
ErrorNoInternet	ab0f9a2ff2	treewide: create global user list	2026-05-04 01:27:10 -04:00
javalsai	fb9526fec2	docs: add sections and fix typos/errors	2026-05-04 00:45:22 -04:00
ErrorNoInternet	0692e680b8	treewide: initialize npins	2026-05-04 00:45:22 -04:00
ErrorNoInternet	3a940586d5	treewide: refactor code	2026-05-04 00:45:21 -04:00
javalsai	7e7097f457	nixos/security: add acme through dns challenge few side refactors of this: - no more `dns.domain`, it all must rely on `fqdn`, prevents inconsistencies. - also added an specific host `tuxcord-acmetest` that uses the key zone for `nix.tuxcord.net` to test certificate pulling.	2026-05-04 00:45:21 -04:00
javalsai	22b3a95bf8	docs: document installation, secrets, and setup steps	2026-05-04 00:45:21 -04:00
javalsai	de4b8833bd	nixos/services: make dns configuration easier	2026-05-04 00:45:21 -04:00
javalsai	ac9b80573f	nixos/service: add dns (bind named server)	2026-05-04 00:45:21 -04:00
javalsai	66a15a5d19	nixos/programs: add bind utils	2026-05-04 00:45:21 -04:00
javalsai	7e331f5e1a	nixos/services: add gitea server	2026-05-04 00:45:21 -04:00
javalsai	a8374e231f	nixos/services: add nginx base configuration	2026-05-04 00:45:21 -04:00
javalsai	27b861d5a5	nixos/networking: add own fqdn to extraHosts	2026-05-04 00:45:21 -04:00
javalsai	6a29ac005c	nixos/hosts: add tuxcord-vm host configuration	2026-05-04 00:45:21 -04:00
ErrorNoInternet	0b9f76dcb4	nixos: separate openssh firewall port	2026-05-04 00:45:21 -04:00
javalsai	cc52b0e6cb	lib/ssh: add more ssh keys	2026-05-04 00:41:23 -04:00