From 5e2e5d1ddb5f75be8a519deb409090512413e8df Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Thu, 20 Mar 2025 20:48:59 +0100
Subject: [PATCH] lkjdsalkjdsalkjdsalkj

---
 flake.nix                                |  1 +
 justfile                                 | 14 +++++++++-----
 profiles/http/default.nix                | 10 ++++++++++
 profiles/http/services/cryptpad.nix      |  4 ++--
 profiles/http/services/invidious.nix     |  1 +
 profiles/http/services/plex.nix          |  1 +
 profiles/http/services/redlib.nix        |  1 +
 profiles/http/services/thelounge.nix     |  1 +
 profiles/http/services/webdav-zotero.nix |  2 ++
 9 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/flake.nix b/flake.nix
index 714a3e7..754b25e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -156,6 +156,7 @@
     inputs-2003 = inputs-2305 // { nixpkgs = inputs'.nixpkgs-2003; };
     inputs-1909 = inputs-2305 // { nixpkgs = inputs'.nixpkgs-1909; };
     inputs-test = inputs-edge // { nixpkgs = inputs'.nixpkgs-test; unstable = inputs'.nixpkgs-test; };
+    inputs-241T = inputs-2411 // { unstable = inputs'.nixpkgs-test; };
 
     forSystems = systems: f: inputs-edge.nixpkgs.lib.genAttrs systems (system: f rec {
       inherit system;
diff --git a/justfile b/justfile
index c60f1fe..20ef2e4 100644
--- a/justfile
+++ b/justfile
@@ -16,10 +16,10 @@ repl $hostname=`just _a_host`:
   NIX_NO_NOM=1 nixos-rebuild --flake .#"$hostname" repl
 
 report hostname=`just _a_host`:
-  nix eval .#nixosReports."{{hostname}}" --json | yq . --yaml-output | bat --language yaml --style plain --paging never
+  nix eval .#nixosReports."{{hostname}}" --json --show-trace | yq . --yaml-output --width=999999 | bat --language yaml --style plain --paging never
 
 reports:
-  nix eval .#nixosReports --json | yq . --yaml-output | bat --language yaml --style plain --paging never
+  nix eval .#nixosReports --json --show-trace | yq . --yaml-output --width=999999 | bat --language yaml --style plain --paging never
 
 update:
   git reset flake.lock
@@ -80,6 +80,7 @@ inspect-config host=`just _a_host` prefix="":
 
 @_a_host:
   hostnames="$(nix eval .#nixosConfigurations --apply builtins.attrNames --json 2>/dev/null | jq '.[]' -r)"; \
+  if test "$(grep <<<"$hostnames" "^$(just remote-current)$" | wc -l)" -eq 1; then hostnames="$(just remote-current; grep <<<"$hostnames" -v "^$(just remote-current)$")"; fi; \
   if test "$(grep <<<"$hostnames" "^$(hostname)$" | wc -l)" -eq 1; then hostnames="$(hostname; grep <<<"$hostnames" -v "^$(hostname)$")"; fi; \
   gum <<<"$hostnames" filter --placeholder "Pick a host..."
 
@@ -105,8 +106,9 @@ inspect-config host=`just _a_host` prefix="":
   gum <<<"$hostnames" filter --placeholder "Pick a host..." --no-limit
 
 @remote-current:
-  # printf "%s\n" "Current remote: $(remote-host)" # slow
-  printf "%s\n" "Current remote: $(tomlq <.remote.toml '.hosts | to_entries[] | select(.value.default==true) | .value.host' -r)"
+  # remote-host # slow
+  test ! -s .remote.toml || \
+  printf "%s\n" "$(tomlq <.remote.toml '.hosts | to_entries[] | select(.value.default==true) | .value.host' -r)"
 
 @remote-list:
   tomlq <.remote.toml '.hosts | to_entries[] | "remote-set \(.key+1) # -> \(.value.host)"' -r
@@ -114,7 +116,9 @@ inspect-config host=`just _a_host` prefix="":
 @remote-set remote=`just remote-current >&2 && just _a_remote_label`:
   remote-set "{{remote}}"
 
-@motd: remote-current remote-list
+@motd:
+  printf "%s\n" "Current remote: $(just remote-current)"
+  just remote-list
   printf "\n"; \
   todos=$(rg 'TODO' | wc -l); \
   if [[ "$todos" -gt 10 ]]; then \
diff --git a/profiles/http/default.nix b/profiles/http/default.nix
index d539cd7..39c5767 100644
--- a/profiles/http/default.nix
+++ b/profiles/http/default.nix
@@ -17,6 +17,16 @@ in
       (lib.sort (x: y: x<y))
     ];
   };
+  options.pbsds.nginx.allowList.extraConfig = lib.mkOption {
+    visible = false; internal = true; readOnly = true;
+    default = ''
+     # home https://ipinfo.io/ips/193.71.0.0/16
+     allow 193.71.0.0/16;
+     # ntnu https://ipinfo.io/ips/129.241.0.0/16
+     allow 129.241.0.0/16;
+     deny all;
+    '';
+  };
 
 
   config = {
diff --git a/profiles/http/services/cryptpad.nix b/profiles/http/services/cryptpad.nix
index da6d198..c526a15 100644
--- a/profiles/http/services/cryptpad.nix
+++ b/profiles/http/services/cryptpad.nix
@@ -12,7 +12,7 @@ in
   services.cryptpad = {
     #enable = true; # current node version used is marked insecure
     # reference: https://github.com/xwiki-labs/cryptpad/blob/main/config/config.example.js
-    configFile = toFile "cryptpad-config.js" ''
+    configFile = builtins.toFile "cryptpad-config.js" ''
       module.exports = {
         httpUnsafeOrigin: 'http://localhost:3457',
         httpSafeOrigin: 'https://${mkDomain "cryptpad"}',
@@ -32,7 +32,7 @@ in
 
         filePath: './datastore/',
         archivePath: './data/archive', // recovery in the event of accidental deletion
-        pinPath: './data/pins', // content stored indefinetly
+        pinPath: './data/pins', // content stored indefinitely
         taskPath: './data/tasks', // scheduled tasks
         blockPath: './block', // users' authenticated blocks
         blobPath: './blob', // uploaded encrypted blobs
diff --git a/profiles/http/services/invidious.nix b/profiles/http/services/invidious.nix
index cb6c439..98fdf52 100644
--- a/profiles/http/services/invidious.nix
+++ b/profiles/http/services/invidious.nix
@@ -42,6 +42,7 @@ in
     locations."/" = {
       proxyPass = "http://127.0.0.1:${toString config.services.invidious.port}";
       proxyWebsockets = true;
+      inherit (config.pbsds.nginx.allowList) extraConfig;
     };
   };
 
diff --git a/profiles/http/services/plex.nix b/profiles/http/services/plex.nix
index b97cf5c..5e3fd16 100644
--- a/profiles/http/services/plex.nix
+++ b/profiles/http/services/plex.nix
@@ -48,6 +48,7 @@ lib.mkIf (!config.virtualisation.isVmVariant)
     locations."/" = {
       proxyPass = "http://127.0.0.1:32400"; # TODO: make configurable
       proxyWebsockets = true;
+      # TODO: inherit (config.pbsds.nginx.allowList) extraConfig;
     };
     # from https://wiki.nixos.org/wiki/Plex
     extraConfig = ''
diff --git a/profiles/http/services/redlib.nix b/profiles/http/services/redlib.nix
index 9d150ce..ed8d173 100644
--- a/profiles/http/services/redlib.nix
+++ b/profiles/http/services/redlib.nix
@@ -23,6 +23,7 @@ in
     locations."/" = {
       proxyPass = "http://127.0.0.1:${toString config.services.redlib.port}";
       proxyWebsockets = true;
+      inherit (config.pbsds.nginx.allowList) extraConfig;
     };
   };
   services.nginx.virtualHosts.${mkDomain "libreddit"} = lib.mkIf config.services.redlib.enable {
diff --git a/profiles/http/services/thelounge.nix b/profiles/http/services/thelounge.nix
index b5d483c..2327f07 100644
--- a/profiles/http/services/thelounge.nix
+++ b/profiles/http/services/thelounge.nix
@@ -30,6 +30,7 @@ in
     locations."/" = {
       proxyPass = "http://127.0.0.1:${toString config.services.thelounge.port}";
       proxyWebsockets = true;
+      inherit (config.pbsds.nginx.allowList) extraConfig;
     };
   };
 }
diff --git a/profiles/http/services/webdav-zotero.nix b/profiles/http/services/webdav-zotero.nix
index 439fb5e..6844b1a 100644
--- a/profiles/http/services/webdav-zotero.nix
+++ b/profiles/http/services/webdav-zotero.nix
@@ -69,6 +69,8 @@ in
 
         proxy_request_buffering off;
         client_max_body_size 2G;
+
+        ${config.pbsds.nginx.allowList.extraConfig}
       '';
     };
   };