From c153a351659e4596acfc31f00bf594343cbfcd68 Mon Sep 17 00:00:00 2001
From: Benedikt Peetz <benedikt.peetz@b-peetz.de>
Date: Thu, 30 Jul 2026 14:05:39 +0200
Subject: modules: Use namespaces

That might make it easier in the future to merge different server
configs together (and thusly facilitate code-reuse.).
---
 modules/vhack/ni/nix-sync/module.nix | 108 +++++++++++++++++++++++++++++++++++
 1 file changed, 108 insertions(+)
 create mode 100644 modules/vhack/ni/nix-sync/module.nix

(limited to 'modules/vhack/ni/nix-sync/module.nix')

diff --git a/modules/vhack/ni/nix-sync/module.nix b/modules/vhack/ni/nix-sync/module.nix
new file mode 100644
index 0000000..9ddd210
--- /dev/null
+++ b/modules/vhack/ni/nix-sync/module.nix
@@ -0,0 +1,108 @@
+{
+  config,
+  lib,
+  modulesPath,
+  nixLib,
+  ...
+}: let
+  cfg = config.vhack.nix-sync;
+
+  mkNixSyncRepository = {
+    domain,
+    repositoryUrl,
+    extraSettings,
+  }: {
+    name = "${domain}";
+    value = {
+      path = "/etc/nginx/websites/${domain}";
+      uri = "${repositoryUrl}";
+      inherit extraSettings;
+    };
+  };
+  nixSyncRepositories = builtins.listToAttrs (builtins.map mkNixSyncRepository cfg.domains);
+
+  mkVirtHost = {
+    domain,
+    repositoryUrl,
+    extraSettings,
+  }: {
+    name = "${domain}";
+    value =
+      # FIXME(@bpeetz): We cannot use something like `lib.recursiveUpdate` because the
+      # `extraSettings` are instantiated from the “real” nginx type. As such the
+      # `extaSettings` would override our values here. Therefore, the direct merge. <2025-02-07>
+      extraSettings
+      // {
+        forceSSL = true;
+        enableACME = true;
+        root = "/etc/nginx/websites/${domain}";
+      };
+  };
+  virtHosts = builtins.listToAttrs (builtins.map mkVirtHost cfg.domains);
+in {
+  imports = [
+    ./internal_module.nix
+  ];
+
+  options.vhack.nix-sync = {
+    enable = lib.mkEnableOption ''
+      a website git ops solution.
+    '';
+
+    domains = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule {
+        options = {
+          domain = lib.mkOption {
+            type = lib.types.str;
+            example = "b-peetz.de";
+            description = ''
+              The fully qualified domain to use as base of this website.
+            '';
+          };
+          repositoryUrl = lib.mkOption {
+            type = lib.types.str;
+            example = "b-peetz.de";
+            description = ''
+              The url used for the source git repository, which is deployed at this domain.
+            '';
+          };
+          extraSettings = lib.mkOption {
+            type =
+              lib.types.submodule (import (modulesPath + "/services/web-servers/nginx/vhost-options.nix") {inherit config lib;});
+            example = {
+              locations."/.well-known/openpgpkey/".extraConfig = "default_type application/octet-stream";
+            };
+            default = {};
+            description = ''
+              Extra configuration to add to the nginx virtual host.
+            '';
+          };
+        };
+      });
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    vhack.persist.directories = [
+      {
+        directory = "/var/lib/nix-sync";
+        user = "nix-sync";
+        group = "nix-sync";
+        mode = "0700";
+      }
+    ];
+
+    services.nix-sync = {
+      enable = true;
+      repositories = nixSyncRepositories;
+    };
+
+    vhack.nginx.enable = true;
+    services.nginx.virtualHosts = virtHosts;
+
+    users = {
+      users.nix-sync.uid = config.vhack.constants.ids.uids.nix-sync;
+      groups.nix-sync.gid = config.vhack.constants.ids.gids.nix-sync;
+    };
+  };
+}
-- 
cgit v1.3.1