posixlycorrect: vps: add irc support

home/modules/default.nix

@@ -21,5 +21,6 @@
     ./mapping.nix
     ./zed.nix
     ./pass.nix
+    ./halloy.nix
   ];
 }

home/modules/halloy.nix

@@ -0,0 +1,42 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.local.apps.halloy;
+in {
+  options.local.apps.halloy = {
+    enable = mkEnableOption "halloy irc client";
+  };
+  config = mkIf cfg.enable {
+    programs.halloy = {
+      enable = true;
+      settings = {
+        buffer = {
+          channel.topic = {
+            enabled = true;
+          };
+          chathistory.infinite_scroll = true;
+        };
+
+        servers.liberachat = {
+          nickname = "posixlycorrect";
+          nick_password_command = "pass show liberachat_irc";
+
+          username = "fabiansoju/irc.libera.chat";
+          password_command = "pass show soju";
+
+          server = "soju.posixlycorrect.com";
+          port = 6697;
+          chathistory = true;
+          channels = [
+            "#lobsters"
+            
+          ];
+        };
+      };
+    };
+  };
+}

home/platforms/fabian@posixlycorrect/default.nix

@@ -48,6 +48,7 @@
       firefox.enable = true;
       mapping.enable = true;
       zed.enable = true;
+      halloy.enable = true;
     };
 
     gui = {

sys/platforms/vps/srv/default.nix

@@ -18,5 +18,6 @@ with lib; {
     ./immich.nix
     ./mealie.nix
     ./dufs.nix
+    ./soju.nix
   ];
 }

sys/platforms/vps/srv/net.nix

@@ -7,6 +7,24 @@
 with lib; let
   inherit (config.local.sys) nets;
 in {
+  # adds "/var/lib/acme/acme-challenge" as a webroot fallback
+  options = {
+    security.acme = {
+      certs = mkOption {
+        type = with types;
+          attrsOf (submodule ({config, ...}: {
+            config = {
+              webroot =
+                if config.dnsProvider == null
+                then "/var/lib/acme/acme-challenge"
+                else null;
+            };
+          }));
+      };
+    };
+  };
+
+  config = {
     networking = {
       nftables.enable = false; # learn how to use this later
       firewall = {
@@ -19,7 +37,9 @@ in {
     # ver https://nixos.org/manual/nixos/stable/index.html#module-security-acme-nginx
     security.acme = {
       acceptTerms = true;
-    defaults.email = "fabian@posixlycorrect.com";
+      defaults = {
+        email = "fabian@posixlycorrect.com";
+      };
     };
 
     services = {
@@ -76,4 +96,5 @@ in {
         };
       };
     };
+  };
 }

sys/platforms/vps/srv/soju.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+with lib; {
+  security.acme.certs."soju.posixlycorrect.com" = {
+    reloadServices = ["soju.service"];
+    group = "soju";
+  };
+
+  networking.firewall.allowedTCPPorts = [6697];
+
+  services.soju = let
+    sojuCertDir = config.security.acme.certs."soju.posixlycorrect.com".directory;
+  in {
+    enable = true;
+    hostName = "soju.posixlycorrect.com";
+    listen = ["ircs://[::]:6697"];
+    tlsCertificate = "${sojuCertDir}/fullchain.pem";
+    tlsCertificateKey = "${sojuCertDir}/key.pem";
+  };
+
+  systemd.services.soju = {
+    after = ["acme-soju.posixlycorrect.com.service"];
+    serviceConfig = {
+      DynamicUser = mkForce false; # fuck dynamic users
+      User = "soju";
+      Group = "soju";
+      ProtectSystem = "strict";
+      ProtectHome = "read-only";
+      PrivateTmp = true;
+      RemoveIPC = true;
+    };
+  };
+
+  users = {
+    users.soju = {
+      isSystemUser = true;
+      group = "soju";
+    };
+    groups.soju = {};
+  };
+}