feat: add flake.nix for NixOS deployment

2026-09-26 13:10:39 +03:00 · 2026-09-26 13:10:39 +03:00 · a081975234
commit a081975234
parent c3cb1d7046
3 changed files with 144 additions and 31 deletions
--- a/flake.nix
+++ b/flake.nix
@ -0,0 +1,132 @@
+{
+  description = "Serve a folder of Markdown as gemtext, Spartan, WML, and XHTML-MP";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    wapdown = {
+      url = "git+ssh://git@code.randogoth.com:2222/randogoth/wapdown.git";
+      flake = false;
+    };
+    md2txt = {
+      url = "git+ssh://git@code.randogoth.com:2222/randogoth/md2txt.git";
+      flake = false;
+    };
+  };
+
+  outputs = { self, nixpkgs, flake-utils, wapdown, md2txt }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+        python = pkgs.python313;
+
+        wapdownPkg = python.pkgs.buildPythonPackage {
+          pname = "wapdown";
+          version = "0.1.0";
+          pyproject = true;
+          src = wapdown;
+          build-system = [ python.pkgs.setuptools python.pkgs.wheel ];
+        };
+
+        md2txtPkg = python.pkgs.buildPythonPackage {
+          pname = "md2txt";
+          version = "0.1.0";
+          pyproject = true;
+          src = md2txt;
+          build-system = [ python.pkgs.setuptools python.pkgs.wheel ];
+          dependencies = [ python.pkgs.pyfiglet python.pkgs.pyphen ];
+        };
+
+        smolwebPkg = python.pkgs.buildPythonApplication {
+          pname = "smolweb";
+          version = "0.1.0";
+          pyproject = true;
+          src = ./.;
+          build-system = [ python.pkgs.setuptools python.pkgs.wheel ];
+          dependencies = [ wapdownPkg md2txtPkg ];
+          nativeCheckInputs = [ python.pkgs.pytestCheckHook ];
+          # Needs a real openssl binary on PATH at runtime (cert
+          # autogeneration shells out to it) as well as at test time.
+          makeWrapperArgs = [ "--prefix" "PATH" ":" "${pkgs.openssl}/bin" ];
+        };
+      in
+      {
+        packages.default = smolwebPkg;
+
+        devShells.default = pkgs.mkShell {
+          packages = [ python pkgs.uv pkgs.openssl pkgs.netcat-gnu pkgs.libxml2 ];
+        };
+      }
+    ) // {
+      nixosModules.default = { config, lib, pkgs, ... }:
+        let
+          cfg = config.services.smolweb;
+        in
+        {
+          options.services.smolweb = with lib; {
+            enable = mkEnableOption "the smolweb capsule server";
+            package = mkOption {
+              type = types.package;
+              default = self.packages.${pkgs.system}.default;
+              description = "smolweb package to run.";
+            };
+            root = mkOption {
+              type = types.path;
+              description = "Folder of Markdown to serve.";
+            };
+            host = mkOption {
+              type = types.str;
+              description = "Hostname this server answers to.";
+            };
+            geminiAddr = mkOption {
+              type = types.str;
+              default = ":1965";
+              description = "Gemini listen address; empty disables it.";
+            };
+            spartanAddr = mkOption {
+              type = types.str;
+              default = ":300";
+              description = "Spartan listen address; empty disables it.";
+            };
+            httpAddr = mkOption {
+              type = types.str;
+              default = ":8080";
+              description = "HTTP listen address; empty disables it.";
+            };
+          };
+
+          config = lib.mkIf cfg.enable {
+            systemd.services.smolweb = {
+              description = "smolweb capsule server";
+              after = [ "network.target" ];
+              wantedBy = [ "multi-user.target" ];
+              serviceConfig = {
+                ExecStart = lib.concatStringsSep " " (
+                  [
+                    "${cfg.package}/bin/smolweb"
+                    "--root" cfg.root
+                    "--host" cfg.host
+                    "--cert" "/var/lib/smolweb/cert.pem"
+                    "--key" "/var/lib/smolweb/key.pem"
+                  ]
+                  ++ lib.optionals (cfg.geminiAddr != "") [ "--gemini" cfg.geminiAddr ]
+                  ++ lib.optionals (cfg.spartanAddr != "") [ "--spartan" cfg.spartanAddr ]
+                  ++ lib.optionals (cfg.httpAddr != "") [ "--http" cfg.httpAddr ]
+                );
+                DynamicUser = true;
+                StateDirectory = "smolweb";
+                # Spartan's default port (300) and Gemini's TLS handshake
+                # both need this rather than running the whole service as
+                # root -- DynamicUser alone can't bind a privileged port.
+                AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+                NoNewPrivileges = true;
+                ProtectSystem = "strict";
+                ProtectHome = true;
+                Restart = "on-failure";
+                RestartSec = "5s";
+              };
+            };
+          };
+        };
+    };
+}