add tangled knot

.gitignore

···
+secrets/

common/ssh.nix

···
+{
+  sshKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXV831n1pGaHBtnMgpYu+qkRbtiE+kEd/xXhxBwp5tk [e-mail]"
+  ];
+}

flake.lock

···
+{
+  "nodes": {
+    "actor-typeahead-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1762835797,
+        "narHash": "sha256-heizoWUKDdar6ymfZTnj3ytcEv/L4d4fzSmtr0HlXsQ=",
+        "ref": "refs/heads/main",
+        "rev": "677fe7f743050a4e7f09d4a6f87bbf1325a06f6b",
+        "revCount": 6,
+        "type": "git",
+        "url": "https://tangled.org/@jakelazaroff.com/actor-typeahead"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://tangled.org/@jakelazaroff.com/actor-typeahead"
+      }
+    },
+    "colmena": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs",
+        "stable": "stable"
+      },
+      "locked": {
+        "lastModified": 1684127108,
+        "narHash": "sha256-01bfuSY4gnshhtqA1EJCw2CMsKkAx+dHS+sEpQ2+EAQ=",
+        "owner": "zhaofengli",
+        "repo": "colmena",
+        "rev": "5fdd743a11e7291bd8ac1e169d62ba6156c99be4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "ref": "release-0.4.x",
+        "repo": "colmena",
+        "type": "github"
+      }
+    },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769524058,
+        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1751685974,
+        "narHash": "sha256-NKw96t+BgHIYzHUjkTK95FqYRVKB8DHpVhefWSz/kTw=",
+        "rev": "549f2762aebeff29a2e5ece7a7dc0f955281a1d1",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/flake-compat/archive/549f2762aebeff29a2e5ece7a7dc0f955281a1d1.tar.gz?rev=549f2762aebeff29a2e5ece7a7dc0f955281a1d1"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/flake-compat/archive/main.tar.gz"
+      }
+    },
+    "flake-utils": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "gomod2nix": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "tangled",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763982521,
+        "narHash": "sha256-ur4QIAHwgFc0vXiaxn5No/FuZicxBr2p0gmT54xZkUQ=",
+        "owner": "nix-community",
+        "repo": "gomod2nix",
+        "rev": "02e63a239d6eabd595db56852535992c898eba72",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "gomod2nix",
+        "type": "github"
+      }
+    },
+    "htmx-src": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-nm6avZuEBg67SSyyZUhjpXVNstHHgUxrtBHqJgowU08=",
+        "type": "file",
+        "url": "https://unpkg.com/htmx.org@2.0.4/dist/htmx.min.js"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://unpkg.com/htmx.org@2.0.4/dist/htmx.min.js"
+      }
+    },
+    "htmx-ws-src": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-2fg6KyEJoO24q0fQqbz9RMaYNPQrMwpZh29tkSqdqGY=",
+        "type": "file",
+        "url": "https://cdn.jsdelivr.net/npm/htmx-ext-ws@2.0.2"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://cdn.jsdelivr.net/npm/htmx-ext-ws@2.0.2"
+      }
+    },
+    "ibm-plex-mono-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1731402384,
+        "narHash": "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=",
+        "type": "tarball",
+        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
+      }
+    },
+    "indigo": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1753693716,
+        "narHash": "sha256-DMIKnCJRODQXEHUxA+7mLzRALmnZhkkbHlFT2rCQYrE=",
+        "owner": "oppiliappan",
+        "repo": "indigo",
+        "rev": "5f170569da9360f57add450a278d73538092d8ca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oppiliappan",
+        "repo": "indigo",
+        "type": "github"
+      }
+    },
+    "inter-fonts-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1731687360,
+        "narHash": "sha256-5vdKKvHAeZi6igrfpbOdhZlDX2/5+UvzlnCQV6DdqoQ=",
+        "type": "tarball",
+        "url": "https://github.com/rsms/inter/releases/download/v4.1/Inter-4.1.zip"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/rsms/inter/releases/download/v4.1/Inter-4.1.zip"
+      }
+    },
+    "lucide-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1754044466,
+        "narHash": "sha256-+exBR2OToB1iv7ZQI2S4B0lXA/QRvC9n6U99UxGpJGs=",
+        "type": "tarball",
+        "url": "https://github.com/lucide-icons/lucide/releases/download/0.536.0/lucide-icons-0.536.0.zip"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/lucide-icons/lucide/releases/download/0.536.0/lucide-icons-0.536.0.zip"
+      }
+    },
+    "nixery-flake": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1762501370,
+        "narHash": "sha256-WO2NvvFB3KkFfChE5F6ghog7mvBAVKpMsQMqwadZT4k=",
+        "owner": "tazjin",
+        "repo": "nixery",
+        "rev": "be8a4005de3f27f95e677e7b61abef387d4a840d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tazjin",
+        "repo": "nixery",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1683408522,
+        "narHash": "sha256-9kcPh6Uxo17a3kK3XCHhcWiV1Yu1kYj22RHiymUhMkU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "897876e4c484f1e8f92009fd11b7d988a121a4e7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1770770419,
+        "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1766070988,
+        "narHash": "sha256-G/WVghka6c4bAzMhTwT2vjLccg/awmHkdKSd2JrycLc=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "c6245e83d836d0433170a16eb185cefe0572f8b8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "colmena": "colmena",
+        "disko": "disko",
+        "nixery-flake": "nixery-flake",
+        "nixpkgs": "nixpkgs_2",
+        "tangled": "tangled"
+      }
+    },
+    "sqlite-lib-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1706631843,
+        "narHash": "sha256-bJoMjirsBjm2Qk9KPiy3yV3+8b/POlYe76/FQbciHro=",
+        "type": "tarball",
+        "url": "https://sqlite.org/2024/sqlite-amalgamation-3450100.zip"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://sqlite.org/2024/sqlite-amalgamation-3450100.zip"
+      }
+    },
+    "stable": {
+      "locked": {
+        "lastModified": 1669735802,
+        "narHash": "sha256-qtG/o/i5ZWZLmXw108N2aPiVsxOcidpHJYNkT45ry9Q=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "731cc710aeebecbf45a258e977e8b68350549522",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-22.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "tangled": {
+      "inputs": {
+        "actor-typeahead-src": "actor-typeahead-src",
+        "flake-compat": "flake-compat_2",
+        "gomod2nix": "gomod2nix",
+        "htmx-src": "htmx-src",
+        "htmx-ws-src": "htmx-ws-src",
+        "ibm-plex-mono-src": "ibm-plex-mono-src",
+        "indigo": "indigo",
+        "inter-fonts-src": "inter-fonts-src",
+        "lucide-src": "lucide-src",
+        "nixpkgs": "nixpkgs_3",
+        "sqlite-lib-src": "sqlite-lib-src"
+      },
+      "locked": {
+        "lastModified": 1770998198,
+        "narHash": "sha256-tlOJXBiJ2Az701a5SXpFdfz8d4QcyoRe7f/L6z0OMJo=",
+        "ref": "refs/heads/master",
+        "rev": "2c65fbc9ccbc60851da549afd88113b1f6ad55d4",
+        "revCount": 1948,
+        "type": "git",
+        "url": "https://tangled.org/tangled.org/core"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://tangled.org/tangled.org/core"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

···
+{
+  description = "nix infra for malpercio.dev";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
+    tangled.url = "git+https://tangled.org/tangled.org/core";
+    colmena.url = "github:zhaofengli/colmena/release-0.4.x";
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nixery-flake = {
+      type = "github";
+      owner = "tazjin";
+      repo = "nixery";
+      flake = false;
+    };
+  };
+
+  outputs = { nixpkgs, disko, colmena, nixery-flake, tangled, ... }:
+    let
+      system = "x86_64-linux";
+      commonArgs = import ./common/ssh.nix;
+
+      # Helper function to create nixosConfiguration
+      mkHost = hostname: extraModules:
+        nixpkgs.lib.nixosSystem {
+          inherit system;
+          specialArgs = { inherit commonArgs; };
+          modules = [
+            disko.nixosModules.disko
+            ./hosts/${hostname}/configuration.nix
+          ] ++ extraModules;
+        };
+
+      # Helper function to create colmena host
+      mkColmenaHost = hostname: targetHost: targetPort: extraModules:
+        {
+          deployment = {
+            inherit targetHost;
+            inherit targetPort;
+            targetUser = "hylia";
+            buildOnTarget = true;
+          };
+          boot.isContainer = nixpkgs.lib.mkDefault true;
+          nixpkgs.system = system;
+          time.timeZone = "America/New_York";
+          imports = [
+            disko.nixosModules.disko
+            ./hosts/${hostname}/configuration.nix
+          ] ++ extraModules;
+        };
+
+      # Host configurations
+      hosts = {
+        tangled = {
+          modules = [
+            tangled.nixosModules.knot
+            ./hosts/tangled/services/knot.nix
+            ./hosts/tangled/services/nginx.nix
+            ./hosts/tangled/services/cloudflared.nix
+          ];
+          target = "10.0.0.41";
+        };
+      };
+    in
+    {
+      # nixos-anywhere and nixos-rebuild use these
+      nixosConfigurations = {
+        tangled = mkHost "tangled" hosts.tangled.modules;
+      };
+
+      # colmena uses this
+      colmenaHive = colmena.lib.makeHive {
+        meta = {
+          nixpkgs = nixpkgs.legacyPackages.${system};
+          specialArgs = {
+            inherit commonArgs;
+            nixery-pkgs = import nixery-flake.outPath {
+              pkgs = import nixpkgs { inherit system; };
+            };
+            tangled-pkgs = tangled.packages.x86_64-linux;
+          };
+        };
+
+        defaults = { pkgs, ... }: {
+          environment.systemPackages = [ pkgs.curl ];
+        };
+
+        tangled = mkColmenaHost "tangled" hosts.tangled.target 22 hosts.tangled.modules;
+      };
+    };
+}

hosts/tangled/configuration.nix

···
+{ config, pkgs, modulesPath, lib, system, ... } @ args:
+
+{
+  imports = [
+    (modulesPath + "/virtualisation/proxmox-lxc.nix")
+  ];
+
+  config = {
+    #Provide a default hostname
+    networking.hostName = "tangled";
+    networking.useDHCP = lib.mkDefault true;
+    
+    # Enable QEMU Guest for Proxmox
+    services.qemuGuest.enable = true;
+
+    nix.settings = { sandbox = false; };
+    proxmoxLXC = {
+      manageNetwork = false;
+      privileged = true;
+    };
+    services.fstrim.enable = false;
+
+    # Allow remote updates with flakes and non-root users
+    nix.settings.trusted-users = [ "root" "@wheel" ];
+    nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+    # Enable mDNS for `hostname.local` addresses
+    services.avahi.enable = true;
+    services.avahi.nssmdns4 = true;
+    services.avahi.publish = {
+      enable = true;
+      addresses = true;
+    };
+
+    # Some sane packages we need on every system
+    environment.systemPackages = with pkgs; [
+      cloudflared
+      nano  # for emergencies
+      git # for pulling nix flakes
+      python3 # for ansible
+    ];
+
+    # Don't ask for passwords
+    security.sudo.wheelNeedsPassword = false;
+    security.pam.services.sshd.allowNullPassword = true;
+
+    # Enable ssh
+    services.openssh = {
+      enable = true;
+      openFirewall = true;
+      settings.PermitRootLogin = "yes";
+      settings.PasswordAuthentication = true;
+      settings.PermitEmptyPasswords = "yes";
+      settings.KbdInteractiveAuthentication = false;
+      settings.Macs = [
+        # Current defaults:
+        "[e-mail]"
+        "[e-mail]"
+        "[e-mail]"
+        # Added:
+        "hmac-sha2-256"
+      ];
+    };
+    programs.ssh.startAgent = true;
+
+    services.resolved = {
+      extraConfig = ''
+        Cache=true
+        CacheFromLocalhost=true
+      '';
+    };
+
+    # Add an admin user
+    users.users.hylia = {
+        isNormalUser = true;
+        description = "hylia";
+        extraGroups = [ "networkmanager" "wheel" "docker" ];
+        openssh.authorizedKeys.keys = args.commonArgs.sshKeys;
+    };
+
+    security.sudo.extraRules = [
+      {
+        users = [ "hylia" ];
+        commands = [
+          {
+            command = "ALL";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+
+    system.stateVersion = "25.11";
+  };
+}

hosts/tangled/services/cloudflared.nix

···
+{
+  services.cloudflared = {
+    enable = true;
+    tunnels = {
+      "b2aa87d0-94b1-4650-8bbb-b97000315a3f" = {
+        credentialsFile = "/home/hylia/.cloudflared/b2aa87d0-94b1-4650-8bbb-b97000315a3f.json";
+        ingress = {
+          "knot.malpercio.dev" = "http://127.0.0.1:80";
+        };
+        default = "http_status:404";
+      };
+    };
+  };
+}

hosts/tangled/services/knot.nix

···
+{
+  services.tangled.knot = {
+    enable = true;
+    stateDir = "/home/git";
+    server = {
+      listenAddr = "127.0.0.1:5555";
+      owner = "did:web:malpercio.dev";
+      hostname = "knot.malpercio.dev";
+    };
+  };
+}

hosts/tangled/services/nginx.nix

···
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "knot.malpercio.dev" = {
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:5555";
+
+          extraConfig = ''
+            proxy_set_header X-Forwarded-For $remote_addr;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-Proto $scheme;
+          '';
+        };
+        locations."/events" = {
+          proxyPass = "http://127.0.0.1:5555";
+          extraConfig = ''
+            proxy_set_header X-Forwarded-For $remote_addr;
+            proxy_set_header Host $host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+          '';
+        };
+      };
+    };
+  };
+  networking.firewall.allowedTCPPorts = [ 80 ];
+}