nixos server configurations
kuribo: refactor caddy, add papermario-dx build.json endpoint
+204
-70
+25
secrets/kuribo/papermario-dx-build.json
+25
secrets/kuribo/papermario-dx-build.json
···
1
+
{
2
+
"baseromUrl": "ENC[AES256_GCM,data:GQ8LVJL17pJ8kzdxU7YEnus3ZX7gBO95xdcAGJGMq043fnURqRb21++CAWTFm+/XICm+DfiuFA8pHMKEp0MvNlD5mIGDFBtmzTIaPn11QCM=,iv:+EHYAWbGl1bTemYluxDAO4E0a4SbDHbMwuA+k2+iIbI=,tag:o0BvKJO1Zp6graujgHWv9Q==,type:str]",
3
+
"sccache": {
4
+
"endpoint": "ENC[AES256_GCM,data:Lc7hXbrtT6j35iS9sNgPUwnEhsP8snvQVtoq,iv:H2QpjDD90+Q+T814OFPwUn621k90udGqTGpEDIZcjXE=,tag:qiG4+dwxkMJzO/vJ64vj9g==,type:str]",
5
+
"bucket": "ENC[AES256_GCM,data:MkQxbbWDpQ==,iv:DPDVjzgn0YbWrPouFTlFVOz/ghersSBSr7HzQB6+IZ0=,tag:y0NJvelED0c1fzX9Ypx8HQ==,type:str]",
6
+
"accessKey": "ENC[AES256_GCM,data:PgxncgfKg71JpvNI3zcDVsLxfbQ=,iv:XwlfbtxievXT0GDQBUOWvcW/dX1nt/VJaFVKCKLRuSc=,tag:q9GedCxhCKV3ex9UvxdCNA==,type:str]",
7
+
"secretKey": "ENC[AES256_GCM,data:zUHw1WEZSLOb9N/5eKIp/q0kjtxgWXzNv7dQVClQ0wvzT4TOwe5olg==,iv:lZ8t8hio9vuWmMaqU75VLQyiq4G0Mi0DSdo3Ma3oLDc=,tag:LDi7HDQ5HV2tevL3sXJ8Qw==,type:str]"
8
+
},
9
+
"sops": {
10
+
"age": [
11
+
{
12
+
"recipient": "age1h08rnd0jeddf55l6l3rf6dlwwh7mngcxy92tyz0hfysjqx4wvgrq6vmah2",
13
+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZWGwyd2pUL2hNU1VYMVEy\nT0p1ZEpML1dOK1ZoK3Bscks5RldteFJtMUdNCjFhcXFjR01IVEE4d0p1K2k3c2lN\nTnM3Vm91dGEwaEVTRkhodUZINEtmdVEKLS0tIDY1cTR0OXJzeSs1LzNLbXdLMDdR\na1VneTZlOXlTVXppMGF5OUZZckpGaVUKMRGVmtHhfHs4c8Qnv7cntCRccrh4kHLI\ns+Xu4KSiqW+xTgBB6QKeDypRoDWUk3Jzm6uYqZdfWbCFxbSURrkZow==\n-----END AGE ENCRYPTED FILE-----\n"
14
+
},
15
+
{
16
+
"recipient": "age1dhxleu7puseq4fz5gprzdssprdd452kjry2n47xaqfh22p5eyqfs68zysl",
17
+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3VDVPSDFrdzYxTHJYTkZM\nTTF0Yk1WWDJVbllwaU5tdjhtb2VyYWhiemxNCjRvVHB4YjRHNXlYU1VSanEyUW4y\nUnlUbTdxZEM5dkNMTFpPOVlJbEozS1UKLS0tIGxoRTNxbVVJTWFuOVdPRmU0VmNE\nc0IrQ01LNzFRaklsRWI1THlBSDA4Y1UKVJvM77yd9kp0Q6nOkcrxq6aTANEo898W\nAphZshPVi9wG3AdZnAtkXbhB5V0nnsv098RYgt0u70WYADjw5BVPkQ==\n-----END AGE ENCRYPTED FILE-----\n"
18
+
}
19
+
],
20
+
"lastmodified": "2026-03-22T16:44:04Z",
21
+
"mac": "ENC[AES256_GCM,data:W9PQ84hRNsFl8aBZ7UN09kackvj9k3HIY7o3JGmO2GjEP6tlO5/4Pr9xPQHn5MiPLsO15ghYl5nVkgcoBpOZCuePbzqZtv44SSW4+/DfygpfrT/yhE/UkkeHfifZzbLM09tOnxQEuOFto+oBttPJo9UzFUMXBmnleXZvqv4fr7U=,iv:7hybudHPn5PU7Rq9WqGMEf/MQ3gplyshSCZfMLqcIuY=,tag:VdhS0wewnaRqarwWdXmQeQ==,type:str]",
22
+
"unencrypted_suffix": "_unencrypted",
23
+
"version": "3.11.0"
24
+
}
25
+
}
+78
servers/kuribo/caddy.nix
+78
servers/kuribo/caddy.nix
···
1
+
{ config, pkgs, lib, ... }:
2
+
let
3
+
cfg = config.starhaven.caddy;
4
+
in
5
+
{
6
+
options.starhaven.caddy = {
7
+
extraHandles = lib.mkOption {
8
+
type = lib.types.lines;
9
+
default = "";
10
+
description = "Extra handle blocks for the *.starhaven.dev virtualHost. These are placed before the fallback handler.";
11
+
};
12
+
fallbackHandle = lib.mkOption {
13
+
type = lib.types.lines;
14
+
default = "";
15
+
description = "Fallback handle block (catch-all, placed last).";
16
+
};
17
+
adminEmail = lib.mkOption {
18
+
type = lib.types.str;
19
+
default = "admin@starhaven.dev";
20
+
};
21
+
};
22
+
23
+
config = {
24
+
services.caddy = {
25
+
enable = true;
26
+
package = pkgs.caddy.withPlugins {
27
+
plugins = [ "github.com/caddy-dns/cloudflare@v0.2.2" ];
28
+
hash = "sha256-ea8PC/+SlPRdEVVF/I3c1CBprlVp1nrumKM5cMwJJ3U=";
29
+
};
30
+
email = cfg.adminEmail;
31
+
globalConfig = ''
32
+
on_demand_tls {
33
+
ask http://127.0.0.1:8081
34
+
}
35
+
36
+
acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
37
+
'';
38
+
virtualHosts."*.starhaven.dev" = {
39
+
extraConfig = ''
40
+
tls {
41
+
on_demand
42
+
}
43
+
44
+
handle / {
45
+
redir https://starhaven.dev
46
+
}
47
+
48
+
${cfg.extraHandles}
49
+
50
+
${cfg.fallbackHandle}
51
+
'';
52
+
};
53
+
};
54
+
55
+
environment.etc."ondemand_tls_helper.py" = {
56
+
source = ./ondemand_tls_helper.py;
57
+
mode = "0755";
58
+
};
59
+
60
+
systemd.services.ondemand-tls-helper = {
61
+
description = "On-demand TLS helper for Caddy (returns 200 for allowed domains or proxies to PDS)";
62
+
wantedBy = [ "multi-user.target" ];
63
+
after = [ "network.target" ];
64
+
65
+
serviceConfig = {
66
+
ExecStart = "${pkgs.python3}/bin/python3 /etc/ondemand_tls_helper.py";
67
+
User = "nobody";
68
+
Restart = "always";
69
+
RestartSec = 5;
70
+
};
71
+
};
72
+
73
+
networking.firewall.allowedTCPPorts = [
74
+
80
75
+
443
76
+
];
77
+
};
78
+
}
+2
servers/kuribo/configuration.nix
+2
servers/kuribo/configuration.nix
+1
-1
servers/kuribo/ondemand_tls_helper.py
+1
-1
servers/kuribo/ondemand_tls_helper.py
···
24
24
TIMEOUT = float(os.environ.get("TIMEOUT", "5.0"))
25
25
26
26
# Allowed domain values (lowercase)
27
-
ALLOWED = {"pds", "knot", "spindle"}
27
+
ALLOWED = {"pds", "knot", "spindle", "papermario-dx"}
28
28
29
29
# Configure logging to stderr (systemd/journal-friendly)
30
30
logging.basicConfig(
+65
servers/kuribo/papermario-dx-build.nix
+65
servers/kuribo/papermario-dx-build.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
sops.secrets."papermario-dx/baseromUrl" = {
4
+
sopsFile = ../../secrets/kuribo/papermario-dx-build.json;
5
+
format = "json";
6
+
key = "baseromUrl";
7
+
};
8
+
sops.secrets."papermario-dx/sccache/endpoint" = {
9
+
sopsFile = ../../secrets/kuribo/papermario-dx-build.json;
10
+
format = "json";
11
+
key = "sccache/endpoint";
12
+
};
13
+
sops.secrets."papermario-dx/sccache/bucket" = {
14
+
sopsFile = ../../secrets/kuribo/papermario-dx-build.json;
15
+
format = "json";
16
+
key = "sccache/bucket";
17
+
};
18
+
sops.secrets."papermario-dx/sccache/accessKey" = {
19
+
sopsFile = ../../secrets/kuribo/papermario-dx-build.json;
20
+
format = "json";
21
+
key = "sccache/accessKey";
22
+
};
23
+
sops.secrets."papermario-dx/sccache/secretKey" = {
24
+
sopsFile = ../../secrets/kuribo/papermario-dx-build.json;
25
+
format = "json";
26
+
key = "sccache/secretKey";
27
+
};
28
+
29
+
systemd.services.papermario-dx-build-json = {
30
+
description = "Generate papermario-dx build.json from sops secrets";
31
+
wantedBy = [ "caddy.service" ];
32
+
before = [ "caddy.service" ];
33
+
after = [ "sops-nix.service" ];
34
+
serviceConfig = {
35
+
Type = "oneshot";
36
+
RemainAfterExit = true;
37
+
};
38
+
script = let
39
+
s = name: config.sops.secrets."papermario-dx/${name}".path;
40
+
in ''
41
+
mkdir -p /run/papermario-dx
42
+
cat > /run/papermario-dx/build.json <<ENDJSON
43
+
{
44
+
"baseromUrl": "$(cat ${s "baseromUrl"})",
45
+
"sccache": {
46
+
"endpoint": "$(cat ${s "sccache/endpoint"})",
47
+
"bucket": "$(cat ${s "sccache/bucket"})",
48
+
"accessKey": "$(cat ${s "sccache/accessKey"})",
49
+
"secretKey": "$(cat ${s "sccache/secretKey"})"
50
+
}
51
+
}
52
+
ENDJSON
53
+
chmod 644 /run/papermario-dx/build.json
54
+
'';
55
+
};
56
+
57
+
# Serve the decrypted build.json at papermario-dx.starhaven.dev
58
+
starhaven.caddy.extraHandles = ''
59
+
@papermario-dx host papermario-dx.starhaven.dev
60
+
handle @papermario-dx {
61
+
root * /run/papermario-dx
62
+
file_server
63
+
}
64
+
'';
65
+
}
+19
-69
servers/kuribo/pds.nix
+19
-69
servers/kuribo/pds.nix
···
34
34
};
35
35
};
36
36
37
-
services.caddy = {
38
-
enable = true;
39
-
package = pkgs.caddy.withPlugins {
40
-
plugins = [ "github.com/caddy-dns/cloudflare@v0.2.2" ];
41
-
hash = "sha256-ea8PC/+SlPRdEVVF/I3c1CBprlVp1nrumKM5cMwJJ3U=";
42
-
};
43
-
email = pdsSettings.PDS_ADMIN_EMAIL;
44
-
globalConfig = ''
45
-
on_demand_tls {
46
-
ask http://127.0.0.1:8081
47
-
}
48
-
49
-
acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
50
-
'';
51
-
virtualHosts."*.starhaven.dev" = {
52
-
extraConfig = ''
53
-
tls {
54
-
on_demand
55
-
}
56
-
57
-
handle / {
58
-
redir https://starhaven.dev
59
-
}
60
-
61
-
@knot host ${toString config.services.tangled.knot.server.hostname}
62
-
handle @knot {
63
-
reverse_proxy http://${toString config.services.tangled.knot.server.listenAddr}
64
-
}
65
-
66
-
@spindle host ${toString config.services.tangled.spindle.server.hostname}
67
-
handle @spindle {
68
-
reverse_proxy http://${toString config.services.tangled.spindle.server.listenAddr}
69
-
}
70
-
71
-
handle /xrpc/app.bsky.unspecced.getAgeAssuranceState {
72
-
header content-type "application/json"
73
-
header access-control-allow-headers "authorization,dpop,atproto-accept-labelers,atproto-proxy"
74
-
header access-control-allow-origin "*"
75
-
respond `{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured"}` 200
76
-
}
37
+
# Caddy config
38
+
starhaven.caddy.adminEmail = pdsSettings.PDS_ADMIN_EMAIL;
39
+
starhaven.caddy.extraHandles = ''
40
+
handle /xrpc/app.bsky.unspecced.getAgeAssuranceState {
41
+
header content-type "application/json"
42
+
header access-control-allow-headers "authorization,dpop,atproto-accept-labelers,atproto-proxy"
43
+
header access-control-allow-origin "*"
44
+
respond `{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured"}` 200
45
+
}
46
+
'';
47
+
starhaven.caddy.fallbackHandle = ''
48
+
handle {
49
+
reverse_proxy http://127.0.0.1:${toString pdsSettings.PDS_PORT}
50
+
}
51
+
'';
77
52
78
-
handle {
79
-
reverse_proxy http://127.0.0.1:${toString pdsSettings.PDS_PORT}
80
-
}
81
-
'';
82
-
};
83
-
};
53
+
# Caddy needs the PDS env file for CLOUDFLARE_API_TOKEN
84
54
systemd.services.caddy = {
85
55
after = [
86
56
"ondemand-tls-helper.service"
···
89
59
serviceConfig.EnvironmentFile = config.sops.secrets.pds.path;
90
60
};
91
61
92
-
environment.etc."ondemand_tls_helper.py" = {
93
-
source = ./ondemand_tls_helper.py;
94
-
mode = "0755";
95
-
};
96
-
97
-
systemd.services.ondemand-tls-helper = {
98
-
description = "On-demand TLS helper for Caddy (returns 200 for allowed domains or proxies to PDS)";
99
-
wantedBy = [ "multi-user.target" ];
100
-
after = [ "network.target" ];
101
-
102
-
serviceConfig = {
103
-
ExecStart = "${pkgs.python3}/bin/python3 /etc/ondemand_tls_helper.py";
104
-
Environment = "PDS_PORT=${toString pdsSettings.PDS_PORT}";
105
-
User = "nobody";
106
-
Restart = "always";
107
-
RestartSec = 5;
108
-
};
109
-
};
110
-
111
-
networking.firewall.allowedTCPPorts = [
112
-
80
113
-
443
114
-
];
62
+
# On-demand TLS helper proxies unknown domain checks to PDS
63
+
systemd.services.ondemand-tls-helper.serviceConfig.Environment =
64
+
"PDS_PORT=${toString pdsSettings.PDS_PORT}";
115
65
}
+14
servers/kuribo/tangled.nix
+14
servers/kuribo/tangled.nix
···
1
+
{ config, ... }:
1
2
let
2
3
owner = "did:plc:tjgdahiw3u2djgnigyqeummg";
3
4
in
···
25
26
};
26
27
};
27
28
};
29
+
30
+
# Caddy: reverse proxy to knot and spindle
31
+
starhaven.caddy.extraHandles = ''
32
+
@knot host ${toString config.services.tangled.knot.server.hostname}
33
+
handle @knot {
34
+
reverse_proxy http://${toString config.services.tangled.knot.server.listenAddr}
35
+
}
36
+
37
+
@spindle host ${toString config.services.tangled.spindle.server.hostname}
38
+
handle @spindle {
39
+
reverse_proxy http://${toString config.services.tangled.spindle.server.listenAddr}
40
+
}
41
+
'';
28
42
}