feat(pm/teal): add menu

menu is the golinks provider and URL shortener that we're writing. So we
can start using it right away, it would be good to host it on teal ASAP

packetmix/systems/teal/headscale.nix

···
           "2606:4700:4700::1111"
           "2606:4700:4700::1001"
         ];
+        search_domains = [ "search.freshly.space" ];
         base_domain = "clicks.domains";
       };
       auth_setup_allow_defer = true; # Otherwise we'll fall back to CLI auth

packetmix/systems/teal/menu.nix

···
+# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
+#
+# SPDX-License-Identifier: MIT
+
+{
+  project,
+  system,
+  config,
+  ...
+}:
+{
+  users.users.menu = {
+    isSystemUser = true;
+    group = "menu";
+  };
+  users.groups.menu = { };
+
+  systemd.services.menu = {
+    wantedBy = [ "default.target" ];
+    script = ''
+      ${project.packages.menu.result.${system}}/bin/menu
+    '';
+    serviceConfig = {
+      User = "menu";
+      Group = "menu";
+      PrivateTmp = true;
+    };
+    environment.BIND_ADDR = "127.0.0.1:1038";
+  };
+
+  services.headscale.settings.dns.extra_records = [
+    {
+      # go.search.freshly.space -> teal
+      name = "go.search.freshly.space";
+      type = "A";
+      value = "100.64.0.5";
+    }
+    {
+      # menu.freshlybakedca.ke -> teal
+      name = "menu.freshlybakedca.ke";
+      type = "A";
+      value = "100.64.0.5";
+    }
+  ];
+
+  services.nginx.virtualHosts."menu.freshlybakedca.ke" = {
+    listenAddresses = [
+      "0.0.0.0"
+      "[::0]"
+    ];
+
+    addSSL = true;
+    enableACME = true;
+    acmeRoot = null;
+
+    serverAliases = [ "go.search.freshly.space" ];
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:1038";
+      recommendedProxySettings = true;
+      proxyWebsockets = true;
+
+      extraConfig = ''
+        proxy_set_header X-Webauth-Login "";
+      ''; # TODO: consider setting up oauth2-proxy for internal routes (most of _ except for search) so hyperneutrino/other people who don't have TS on all devices can still use this properly
+    };
+  };
+
+  services.nginx.enable = true;
+  services.nginx.virtualHosts."internal.menu.freshlybakedca.ke" = {
+    listenAddresses = [ "localhost.tailscale" ];
+
+    addSSL = true;
+    enableACME = true;
+    acmeRoot = null;
+
+    serverName = "menu.freshlybakedca.ke";
+
+    serverAliases = [ "go.search.freshly.space" ];
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:1038";
+      recommendedProxySettings = true;
+    };
+  };
+
+  services.nginx.virtualHosts."go" = {
+    listenAddresses = [ "localhost.tailscale" ];
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:1038";
+      recommendedProxySettings = true;
+    };
+  };
+
+  services.nginx.tailscaleAuth = {
+    enable = true;
+    virtualHosts = [
+      "internal.menu.freshlybakedca.ke"
+      "go"
+    ];
+  };
+}

projects/nilla.nix

···
           }) pins;
         }
       )
-    ];
+    ]
+    ++ (
+      if (builtins.readDir ./.) ? "dependencies" then
+        let
+          dependenciesDir = ./dependencies;
+          dependencies = builtins.attrNames (builtins.readDir dependenciesDir);
+          depedencyFiles = map (name: "${./dependencies}/${name}/project.nix") dependencies;
+        in
+        depedencyFiles
+      else
+        [ ]
+    );
 
     args = {
       inherit nilla pins; # pins needs to be a static arg for us to import from it...

projects/packetmix/workspace.josh

···
 ::.tangled/
 ::LICENSES/
+dependencies/menu = :/menu
 ::npins/
 ::nilla.nix=projects/nilla.nix
 ::workspace.josh.license=projects/packetmix/workspace.josh.license