nixify appview

Signed-off-by: Anirudh Oppiliappan <[e-mail]>

flake.lock

···
         ]
       },
       "locked": {
-        "lastModified": 1751854533,
-        "narHash": "sha256-U/OQFplExOR1jazZY4KkaQkJqOl59xlh21HP9mI79Vc=",
+        "lastModified": 1766150702,
+        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "16b74a1e304197248a1bc663280f2548dbfcae3c",
+        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
         "type": "github"
       },
       "original": {
···
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1694529238,
-        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
···
         ]
       },
       "locked": {
-        "lastModified": 1754078208,
-        "narHash": "sha256-YVoIFDCDpYuU3riaDEJ3xiGdPOtsx4sR5eTzHTytPV8=",
+        "lastModified": 1763982521,
+        "narHash": "sha256-ur4QIAHwgFc0vXiaxn5No/FuZicxBr2p0gmT54xZkUQ=",
         "owner": "nix-community",
         "repo": "gomod2nix",
-        "rev": "7f963246a71626c7fc70b431a315c4388a0c95cf",
+        "rev": "02e63a239d6eabd595db56852535992c898eba72",
         "type": "github"
       },
       "original": {
···
     "nixery-flake": {
       "flake": false,
       "locked": {
-        "lastModified": 1745149613,
-        "narHash": "sha256-rcSnsnSWA0IUjmbG2iSpvVB0702tcR3zIyU3iFJBo0g=",
+        "lastModified": 1762501370,
+        "narHash": "sha256-WO2NvvFB3KkFfChE5F6ghog7mvBAVKpMsQMqwadZT4k=",
         "owner": "tazjin",
         "repo": "nixery",
-        "rev": "c6d4692b1b6eb105c9abce0411d2ef4b8708a6e1",
+        "rev": "be8a4005de3f27f95e677e7b61abef387d4a840d",
         "type": "github"
       },
       "original": {
···
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1758427187,
-        "narHash": "sha256-pHpxZ/IyCwoTQPtFIAG2QaxuSm8jWzrzBGjwQZIttJc=",
+        "lastModified": 1767379071,
+        "narHash": "sha256-EgE0pxsrW9jp9YFMkHL9JMXxcqi/OoumPJYwf+Okucw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "554be6495561ff07b6c724047bdd7e0716aa7b46",
+        "rev": "fb7944c166a3b630f177938e478f0378e64ce108",
         "type": "github"
       },
       "original": {
···
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1751984180,
-        "narHash": "sha256-LwWRsENAZJKUdD3SpLluwDmdXY9F45ZEgCb0X+xgOL0=",
+        "lastModified": 1766070988,
+        "narHash": "sha256-G/WVghka6c4bAzMhTwT2vjLccg/awmHkdKSd2JrycLc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9807714d6944a957c2e036f84b0ff8caf9930bc0",
+        "rev": "c6245e83d836d0433170a16eb185cefe0572f8b8",
         "type": "github"
       },
       "original": {
···
         "sqlite-lib-src": "sqlite-lib-src"
       },
       "locked": {
-        "lastModified": 1763358301,
-        "narHash": "sha256-i2fc5A2qoHvubTWhcpG5S6Hy42DlYOyEgJjR6TaQvxg=",
+        "lastModified": 1767683698,
+        "narHash": "sha256-MFrfNmTKTdOOsyXUvvqPwH6zqvDZZpURnd7QdJkVOgU=",
         "ref": "refs/heads/master",
-        "rev": "a17d65a1a78d8889e0b971be2bc5d32be445ce10",
-        "revCount": 1666,
+        "rev": "b31a2a3590fefc4c70817f94a20076df2428b4d3",
+        "revCount": 1791,
         "type": "git",
         "url": "https://tangled.org/@tangled.org/core"
       },

flake.nix

···
       };
       nixosConfigurations.pds = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
+        specialArgs = {
+          commonArgs = import ./common/ssh.nix;
+        };
         modules = [
           disko.nixosModules.disko
           ./hosts/pds/configuration.nix
+        ];
+      };
+      nixosConfigurations.appview = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        specialArgs = {
+          commonArgs = import ./common/ssh.nix;
+        };
+        modules = [
+          disko.nixosModules.disko
+          ./hosts/appview/configuration.nix
         ];
       };
 
···
           environment.systemPackages = [
             pkgs.curl
           ];
+        };
+        appview = { pkgs, ... }: {
+          deployment = {
+            targetHost = "alpha.tangled.sh";
+            targetPort = 22;
+            targetUser = "tangler";
+            buildOnTarget = true;
+          };
+          nixpkgs.system = "x86_64-linux";
+          imports = [
+            disko.nixosModules.disko
+            tangled.nixosModules.appview
+            ./hosts/appview/configuration.nix
+            ./hosts/appview/services/appview.nix
+            ./hosts/appview/services/nginx-alpha.nix
+          ];
+          time.timeZone = "Europe/Helsinki";
         };
         pds = { pkgs, ... }: {
           deployment = {

hosts/appview/configuration.nix

···
+{ modulesPath
+, lib
+, pkgs
+, ...
+} @ args:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+    ./disk-config.nix
+  ];
+  boot.loader.grub = {
+    # no need to set devices, disko will add all devices that have a EF02 partition to the list already
+    # devices = [ ];
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+  };
+
+  networking.hostName = "appview-arn";
+  services = {
+    openssh.enable = true;
+  };
+
+
+  nix = {
+    extraOptions = ''
+      experimental-features = nix-command flakes ca-derivations
+      warn-dirty = false
+      keep-outputs = false
+    '';
+  };
+
+  environment.systemPackages = map lib.lowPrio [
+    pkgs.curl
+    pkgs.gitMinimal
+  ];
+
+  users.users.tangler = {
+    extraGroups = [ "networkmanager" "wheel" ];
+    openssh.authorizedKeys.keys = args.commonArgs.sshKeys;
+    isNormalUser = true;
+  };
+
+  security.sudo.extraRules = [
+    {
+      users = [ "tangler" ];
+      commands = [
+        {
+          command = "ALL";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
+  system.stateVersion = "25.05";
+}

hosts/appview/disk-config.nix

···
+# Example to create a bios compatible gpt partition
+{ lib, ... }:
+{
+  disko.devices = {
+    disk.disk1 = {
+      device = lib.mkDefault "/dev/vda";
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            name = "boot";
+            size = "1M";
+            type = "EF02";
+          };
+          esp = {
+            name = "ESP";
+            size = "500M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+          root = {
+            name = "root";
+            size = "100%";
+            content = {
+              type = "lvm_pv";
+              vg = "pool";
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      pool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100%FREE";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [
+                "defaults"
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/appview/services/appview.nix

···
+{ modulesPath
+, lib
+, pkgs
+, ...
+} @ args:
+{
+  services.tangled.appview = {
+    enable = true;
+    environmentFile = "/etc/secrets/appview.env";
+  };
+}

hosts/appview/services/nginx-alpha.nix

···
+{ config, pkgs, ... }:
+{
+  services.nginx = {
+    enable = true;
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+
+    # Fix proxy headers hash warnings
+    appendHttpConfig = ''
+      proxy_headers_hash_max_size 1024;
+      proxy_headers_hash_bucket_size 128;
+    '';
+
+    virtualHosts = {
+      # AppView service on alpha.tangled.sh
+      "alpha.tangled.sh" = {
+        forceSSL = true;
+        enableACME = true;
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:3000";
+          extraConfig = ''
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            client_max_body_size 100M;
+          '';
+        };
+
+        # WebSocket support for /logs endpoint
+        locations."~ /logs$" = {
+          proxyPass = "http://127.0.0.1:3000";
+          proxyWebsockets = true;
+          extraConfig = ''
+            proxy_read_timeout 86400;
+          '';
+        };
+      };
+    };
+  };
+
+  # Open firewall ports
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  # ACME configuration for Let's Encrypt
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "[e-mail]";
+  };
+}

hosts/appview/services/nginx.nix

···
+{ config, pkgs, ... }:
+{
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+
+    virtualHosts = {
+      # Redirect tangled.sh → tangled.org
+      "tangled.sh" = {
+        serverAliases = [ "www.tangled.sh" ];
+        locations."/" = {
+          return = "301 https://tangled.org$request_uri";
+        };
+        forceSSL = true;
+        enableACME = true;
+      };
+
+      # Redirect strings.tangled.sh → tangled.org/strings/*
+      "strings.tangled.sh" = {
+        locations."/" = {
+          return = "301 https://tangled.org/strings$request_uri";
+        };
+        forceSSL = true;
+        enableACME = true;
+      };
+
+      # Redirect strings.tangled.org → tangled.org/strings/*
+      "strings.tangled.org" = {
+        locations."/" = {
+          return = "301 https://tangled.org/strings$request_uri";
+        };
+        forceSSL = true;
+        enableACME = true;
+      };
+
+      # Main app on tangled.org
+      "tangled.org" = {
+        serverAliases = [ "www.tangled.org" ];
+
+        forceSSL = true;
+        enableACME = true;
+
+        extraConfig = ''
+          # Redirect www → bare domain
+          if ($host = www.tangled.org) {
+            return 301 https://tangled.org$request_uri;
+          }
+
+          client_max_body_size 100M;
+        '';
+
+        locations."~ ^/@tangled\\.sh(/.*)?$" = {
+          return = "301 https://tangled.org/@tangled.org$1$is_args$args";
+        };
+
+        locations."~ ^/tangled\\.sh(/.*)?$" = {
+          return = "301 https://tangled.org/tangled.org$1$is_args$args";
+        };
+
+        locations."~ /logs$" = {
+          proxyPass = "http://127.0.0.1:3000";
+          proxyWebsockets = true;
+          extraConfig = ''
+            proxy_read_timeout 86400;
+          '';
+        };
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:3000";
+          extraConfig = ''
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            include ${config.services.nginx.package}/conf/mime.types;
+          '';
+        };
+      };
+    };
+  };
+
+  # Open firewall ports
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  # ACME configuration for Let's Encrypt
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "[e-mail]";
+  };
+}