feat: package the bridge as a nix flake with a NixOS deploy module

README.md

@@ -24,6 +24,44 @@ Then open http://127.0.0.1:8096. First use: create an identity, back up the seed
 
 For a server on a non-default port, start the bridge with `uv run bridge.py --allow-port <port>`.
 
+## Deploy
+
+`flake.nix` packages the bridge for a server, separately from `devbox`'s local dev loop:
+
+```
+nix build .#default   # -> ./result/bin/gsmol-bridge
+nix run .              # runs it directly, default flags
+```
+
+The package wraps `bridge.py` with `python3` and `aiohttp` from nixpkgs, not `uv` — no network access at build or run time, and the script's `#!/usr/bin/env -S uv run --script` shebang stays relevant only to `devbox run serve`.
+
+For a NixOS host, `nixosModules.default` provides `services.gsmol-bridge`:
+
+```nix
+{
+  inputs.gsmol.url = "git+https://code.randogoth.com/randogoth/gsmol.git";
+
+  outputs = { self, nixpkgs, gsmol, ... }: {
+    nixosConfigurations.mail = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [
+        gsmol.nixosModules.default
+        {
+          services.gsmol-bridge = {
+            enable = true;
+            allowPorts = [ 1961 ];    # smolmaild's port(s)
+            nginx.enable = true;      # TLS via ACME, in front of the bridge
+            nginx.domain = "mail.example.org";
+          };
+        }
+      ];
+    };
+  };
+}
+```
+
+The service runs under `DynamicUser`, restarts on failure, and — like the standalone script — listens on `127.0.0.1` by default. `nginx.enable` puts a TLS-terminating reverse proxy in front rather than exposing the bridge directly: it has no TLS of its own, and a browser refuses a `ws://` connection from an `https://` page, so a real deployment needs the proxy regardless of `--allow-origin`. `openFirewall = true` is for exposing the bridge's port directly instead, which is not the recommended path (see "Notes and limits").
+
 ## What it implements
 
 - **Identity** (§2): one 32-byte seed; create or restore; the X25519 agreement keys are derived from the Ed25519 keypair. The seed lives in localStorage, mail stays sealed in IndexedDB — the browser profile is the trust boundary.
@@ -62,4 +100,4 @@ What is not verified here: clicking through the actual browser UI. `devbox run s
 
 - The seed sits in localStorage: an XSS in the page or a compromised browser profile is game over, same as a stolen `identity.key` for the CLI client. The bridge serves a strict Content-Security-Policy (`default-src 'self'`, no inline script or style, no foreign origin) to raise that bar, but it is a mitigation and not a fix. No server push or notifications in v1 (SPEC.md §13); click fetch.
 - Rotation is not revocation (§7): a stolen key can rotate onward and the chain validates. The UI surfaces rotations instead of applying them invisibly; out-of-band re-verification is the only defence.
-- The bridge binds to 127.0.0.1. Serving it beyond localhost is possible but unadvised: the relay is plaintext-agnostic (the traffic is already end-to-end encrypted, but the bridge would relay anyone's bytes to allowlisted ports).
+- The bridge binds to 127.0.0.1 by default and has no TLS of its own. Serving it beyond localhost directly is possible but unadvised: the relay is plaintext-agnostic (the traffic is already end-to-end encrypted, but the bridge would relay anyone's bytes to allowlisted ports). The NixOS module's `nginx.enable` puts a TLS-terminating reverse proxy in front instead, which is the deployment path "Deploy" above documents.