feat(wolumonde): nsid tracker, use proxyWebsockets, hetzner things [skip ci]

.gitignore

···
 doc/index.html
 keys
 
-# Result of bud commands
-vm
-iso
-doi
-
-pkgs/_sources/.shake*
 ssh_key
 secrets/deploy-webhook.nu
 
 # dnscontrol
 creds.json
+
+# deploy resources
+.hetzner

flake.lock

···
         "type": "github"
       }
     },
+    "crane_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1727316705,
+        "narHash": "sha256-/mumx8AQ5xFuCJqxCIOFCHTVlxHkMT21idpbgbm/TIE=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "5b03654ce046b5167e7b0bccbd8244cb56c16f0e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "ref": "v0.19.0",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
···
         "type": "github"
       }
     },
+    "dream2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nsid-tracker",
+          "nci",
+          "nixpkgs"
+        ],
+        "purescript-overlay": "purescript-overlay",
+        "pyproject-nix": "pyproject-nix"
+      },
+      "locked": {
+        "lastModified": 1752547840,
+        "narHash": "sha256-T6wYez5urMcY8oUetwOIqPcqj77Ey3qka7wQsi6YCd4=",
+        "owner": "nix-community",
+        "repo": "dream2nix",
+        "rev": "667ba5ee25c95cf63ace92307db270e235dce66e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "dream2nix",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
···
         "owner": "edolstra",
         "repo": "flake-compat",
         "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
···
         "url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip"
       }
     },
+    "mk-naked-shell": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1681286841,
+        "narHash": "sha256-3XlJrwlR0nBiREnuogoa5i1b4+w/XPe0z8bbrJASw0g=",
+        "owner": "yusdacra",
+        "repo": "mk-naked-shell",
+        "rev": "7612f828dd6f22b7fb332cc69440e839d7ffe6bd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "yusdacra",
+        "repo": "mk-naked-shell",
+        "type": "github"
+      }
+    },
     "naked-shell": {
       "locked": {
         "lastModified": 1681286841,
···
         "type": "github"
       }
     },
+    "naked-shell_3": {
+      "locked": {
+        "lastModified": 1681286841,
+        "narHash": "sha256-3XlJrwlR0nBiREnuogoa5i1b4+w/XPe0z8bbrJASw0g=",
+        "owner": "90-008",
+        "repo": "mk-naked-shell",
+        "rev": "7612f828dd6f22b7fb332cc69440e839d7ffe6bd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "90-008",
+        "repo": "mk-naked-shell",
+        "type": "github"
+      }
+    },
+    "nci": {
+      "inputs": {
+        "crane": "crane_2",
+        "dream2nix": "dream2nix",
+        "mk-naked-shell": "mk-naked-shell",
+        "nixpkgs": [
+          "nsid-tracker",
+          "nixpkgs"
+        ],
+        "parts": "parts_2",
+        "rust-overlay": "rust-overlay_2",
+        "treefmt": "treefmt"
+      },
+      "locked": {
+        "lastModified": 1752905922,
+        "narHash": "sha256-fhwoEa+rjxLsRANRqh4jl4evnGpVNTLWUf4a/KDkQ3k=",
+        "owner": "yusdacra",
+        "repo": "nix-cargo-integration",
+        "rev": "47e02f590e1e2c72b4ffc2bcf92b2b11c3195395",
+        "type": "github"
+      },
+      "original": {
+        "owner": "yusdacra",
+        "repo": "nix-cargo-integration",
+        "type": "github"
+      }
+    },
+    "ncr": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1752857134,
+        "narHash": "sha256-1ANFEQe6KW3ncMuIOxwLiwvwC3dpALUSYxq9CSPsOz8=",
+        "ref": "refs/heads/main",
+        "rev": "52576c71435602e25555a4116dfb0a42f3412b11",
+        "revCount": 17,
+        "type": "git",
+        "url": "https://tangled.sh/@poor.dog/nixos-cloud-resources"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://tangled.sh/@poor.dog/nixos-cloud-resources"
+      }
+    },
     "nixos-hardware": {
       "locked": {
         "lastModified": 1752048960,
···
         "type": "github"
       }
     },
+    "nixpkgs-lib_3": {
+      "locked": {
+        "lastModified": 1751159883,
+        "narHash": "sha256-urW/Ylk9FIfvXfliA1ywh75yszAbiTEVgpPeinFyVZo=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "14a40a1d7fb9afa4739275ac642ed7301a9ba1ab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs-wayland": {
       "flake": false,
       "locked": {
···
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
+      }
+    },
+    "nsid-tracker": {
+      "inputs": {
+        "naked-shell": "naked-shell_3",
+        "nci": "nci",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "parts": "parts_3",
+        "systems": "systems_6"
+      },
+      "locked": {
+        "lastModified": 1752990833,
+        "narHash": "sha256-c8H6QAX2iIDLaYTLN8b1iOKxnpQouJoSGtDqMuyV9Nw=",
+        "ref": "refs/heads/main",
+        "rev": "73978e71f695685986843f71c46387117fc8f4f8",
+        "revCount": 28,
+        "type": "git",
+        "url": "https://tangled.sh/@poor.dog/nsid-tracker"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://tangled.sh/@poor.dog/nsid-tracker"
       }
     },
     "nur": {
···
         "type": "github"
       }
     },
+    "parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nsid-tracker",
+          "nci",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1751413152,
+        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "parts_3": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_3"
+      },
+      "locked": {
+        "lastModified": 1751413152,
+        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "purescript-overlay": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": [
+          "nsid-tracker",
+          "nci",
+          "dream2nix",
+          "nixpkgs"
+        ],
+        "slimlock": "slimlock"
+      },
+      "locked": {
+        "lastModified": 1728546539,
+        "narHash": "sha256-Sws7w0tlnjD+Bjck1nv29NjC5DbL6nH5auL9Ex9Iz2A=",
+        "owner": "thomashoneyman",
+        "repo": "purescript-overlay",
+        "rev": "4ad4c15d07bd899d7346b331f377606631eb0ee4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "thomashoneyman",
+        "repo": "purescript-overlay",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nsid-tracker",
+          "nci",
+          "dream2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1752481895,
+        "narHash": "sha256-luVj97hIMpCbwhx3hWiRwjP2YvljWy8FM+4W9njDhLA=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "16ee295c25107a94e59a7fc7f2e5322851781162",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
···
         "limbusart": "limbusart",
         "lix-module": "lix-module",
         "naked-shell": "naked-shell_2",
+        "ncr": "ncr",
         "nixos-hardware": "nixos-hardware",
         "nixos-persistence": "nixos-persistence",
         "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs_3",
         "nixpkgs-wayland": "nixpkgs-wayland",
+        "nsid-tracker": "nsid-tracker",
         "nur": "nur",
         "skeetdeck": "skeetdeck",
         "tangled": "tangled"
···
         "type": "github"
       }
     },
+    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nsid-tracker",
+          "nci",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1752892850,
+        "narHash": "sha256-LLvDqLiK2+dr7bQqKTnZIZ8F1H67DLt3FUyVrGolGVw=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "742248f12aed0183a124637e8b27a238a47f46a2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "skeetdeck": {
       "flake": false,
       "locked": {
···
         "url": "file:///home/kirara/proj/skeetdeck-dist.tar.gz"
       }
     },
+    "slimlock": {
+      "inputs": {
+        "nixpkgs": [
+          "nsid-tracker",
+          "nci",
+          "dream2nix",
+          "purescript-overlay",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1688756706,
+        "narHash": "sha256-xzkkMv3neJJJ89zo3o2ojp7nFeaZc2G0fYwNXNJRFlo=",
+        "owner": "thomashoneyman",
+        "repo": "slimlock",
+        "rev": "cf72723f59e2340d24881fd7bf61cb113b4c407c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "thomashoneyman",
+        "repo": "slimlock",
+        "type": "github"
+      }
+    },
     "sqlite-lib-src": {
       "flake": false,
       "locked": {
···
         "type": "github"
       }
     },
+    "systems_6": {
+      "locked": {
+        "lastModified": 1680978846,
+        "narHash": "sha256-Gtqg8b/v49BFDpDetjclCYXm8mAnTrUzR0JnE2nv5aw=",
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "rev": "2ecfcac5e15790ba6ce360ceccddb15ad16d08a8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "type": "github"
+      }
+    },
     "tangled": {
       "inputs": {
         "gitignore": "gitignore",
···
       "original": {
         "type": "git",
         "url": "https://tangled.sh/@tangled.sh/core"
+      }
+    },
+    "treefmt": {
+      "inputs": {
+        "nixpkgs": [
+          "nsid-tracker",
+          "nci",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1752055615,
+        "narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
       }
     }
   },

flake.nix

···
 
     tangled.url = "git+https://tangled.sh/@tangled.sh/core";
     tangled.inputs.nixpkgs.follows = "nixpkgs";
+
+    ncr.url = "git+https://tangled.sh/@poor.dog/nixos-cloud-resources";
+    ncr.inputs.nixpkgs.follows = "nixpkgs";
+
+    nsid-tracker.url = "git+https://tangled.sh/@poor.dog/nsid-tracker";
+    nsid-tracker.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs =
···
             }) cmds
           )
           (
-            lib.mapAttrs (_: pkgs: {
+            lib.mapAttrs
+            (_: pkgs: (
+              lib.mapAttrs
+              (_: app: app.program)
+              (inputs.ncr.makeApps {inherit pkgs; inherit (inputs) self;})
+            ) // {
               generate-firefox-addons = toString "${pkgs.generate-firefox-addons}/bin/generate-firefox-addons";
               dns = toString "${pkgs.dnsmngmt}/bin/dns";
-            }) allPkgs
+            })
+            allPkgs
           );
     in
     {

hosts/wolumonde/default.nix

···
 {
   imports = [
     inputs.agenix.nixosModules.default
-    # inputs.nixtopo.nixosModules.default
+    inputs.ncr.nixosModules.firewall
+    inputs.ncr.nixosModules.firewall-hetzner
   ] ++ (tlib.importFolder (toString ./modules));
 
   environment.systemPackages = with pkgs; [
···
   zramSwap.enable = true;
 
   # firewall stuffs
-  networking.firewall = {
+  networking.firewall.enable = true;
+  providers.hetzner.firewall = {
     enable = true;
-    allowedTCPPorts = [
-      22
-      80
-      443
-      5005
-    ];
-    allowedUDPPortRanges = [ ];
+    id = 476406;
   };
-
-  virtualisation.docker.enable = false;
 
   system.stateVersion = "22.05";
 }

hosts/wolumonde/modules/hardware-configuration.nix

···
     device = "/dev/sda1";
     fsType = "ext4";
   };
+  fileSystems."/mnt/data" = {
+    device = "/dev/disk/by-id/scsi-0HC_Volume_102930299";
+    fsType = "btrfs";
+    options = [ "noatime" "autodefrag" "compress-force=zstd:8" ];
+  };
 }

hosts/wolumonde/modules/netbird.nix

···
       useAcmeCertificates = true;
     };
   };
+  networking.firewall.public."netbird coturn" ={
+    allowedTCPPortRanges = [{from = 3478; to = 3479;}];
+    allowedUDPPortRanges = [{from = 3478; to = 3479;} {from = 49152; to = 65535;}];
+  };
 
   services.nginx.virtualHosts.${cfg.domain} = {
     useACMEHost = "gaze.systems";

hosts/wolumonde/modules/nginx.nix

···
     statusPage = true;
   };
 
+  networking.firewall.public."http(s)".allowedTCPPorts = [80 443];
+
   # output json logs so we can consume them more easily
   services.nginx.appendHttpConfig = ''
     log_format json_logs escape=json '{'

hosts/wolumonde/modules/nsid-tracker.nix

···
+{
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  server = inputs.nsid-tracker.packages.${pkgs.system}.server;
+  client = inputs.nsid-tracker.packages.${pkgs.system}.client.overrideAttrs (old: {
+    PUBLIC_API_URL = "gaze.systems/nsid-tracker/api";
+  });
+  port = 6432;
+in
+{
+  users.users.nsidtracker = {
+    isSystemUser = true;
+    home = "/mnt/data/nsid-tracker";
+    createHome = true;
+    group = "nsidtracker";
+  };
+  users.groups.nsidtracker = { };
+
+  systemd.services.nsid-tracker = {
+    description = "nsid-tracker";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    environment = {
+      HOME = "/mnt/data/nsid-tracker";
+      PORT = toString port;
+    };
+    serviceConfig = {
+      User = "nsidtracker";
+      ExecStart = "${server}/bin/server";
+      Restart = "on-failure";
+      RestartSec = 5;
+      WorkingDirectory = "/mnt/data/nsid-tracker";
+    };
+  };
+
+  services.nginx.virtualHosts."gaze.systems" = {
+    locations."/nsid-tracker/api" = {
+      proxyPass = "http://localhost:${toString port}/";
+      proxyWebsockets = true;
+      extraConfig = ''
+        rewrite ^/nsid-tracker/api/(.*) /$1 break;
+      '';
+    };
+    locations."/nsid-tracker".return = "301 /nsid-tracker/";
+    locations."/nsid-tracker/" = {
+      alias = "${client}/";
+      tryFiles = "$uri $uri/ /index.html";
+    };
+  };
+}

hosts/wolumonde/modules/pds.nix

···
         # silly but i want root domain >:3
         "/xrpc" = {
           proxyPass = pdsLocalhost;
+          proxyWebsockets = true;
           # pass ws headers so we can actually proxy the ws
           extraConfig = ''
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
             proxy_set_header id $request_id;
             client_max_body_size 100M;
           '';

hosts/wolumonde/modules/ssh.nix

···
   users.users.root.openssh.authorizedKeys.keys = [
     (builtins.readFile "${inputs.self}/secrets/yusdacra.key.pub")
   ];
+  networking.firewall.public."ssh".allowedTCPPorts = [22];
 }

hosts/wolumonde/modules/tangled.nix

···
     kTLS = true;
     locations."/" = {
       proxyPass = "http://${knotCfg.server.listenAddr}";
-      extraConfig = ''
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-        proxy_set_header id $request_id;
-      '';
+      proxyWebsockets = true;
     };
   };
 
···
     kTLS = true;
     locations."/" = {
       proxyPass = "http://${spindleCfg.server.listenAddr}";
-      extraConfig = ''
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-        proxy_set_header id $request_id;
-      '';
+      proxyWebsockets = true;
     };
   };
 

hosts/wolumonde/modules/unbound.nix

···
           forward-addr = [
             "1.1.1.1"
             "1.0.0.1"
+            "9.9.9.9"
+            "8.8.8.8"
           ];
         }
       ];