*actually* upload nixcloud configs

2026-03-12 05:15:14 -06:00
parent 18261a9969
commit e8b59f873b
12 changed files with 471 additions and 0 deletions
@@ -0,0 +1,127 @@
+{ config, pkgs, lib, ... }:
+
+let
+  domain       = "frontendfriendly.xyz";
+  host         = "stackoverflow.${domain}";
+  upstreamPort = 7101;
+
+  # 1) Fetch source from GitHub
+  anonymousOverflowSrc = pkgs.fetchFromGitHub {
+    owner  = "httpjamesm";
+    repo   = "AnonymousOverflow";
+    rev    = "v1.13.0";  # pin a release tag
+    # TODO: replace with real hash after first build
+    sha256 = "sha256-hvcOJctvNswEws+cCoeGQSvFzZvnThhKk3fJ7TnNulY=";
+  };
+
+  # 2) Build the Go binary
+  anonymousOverflowPkg = pkgs.buildGoModule {
+    pname   = "anonymousoverflow";
+    version = "1.13.0";
+
+    src = anonymousOverflowSrc;
+
+    # code is at repo root
+    subPackages = [ "." ];
+
+    # TODO: replace with real vendor hash after first build
+    vendorHash = "sha256-P3kUGFJhj/pTNeVTwtg4IqhoHBH9rROfkr+ZsrUtmdo=";
+  };
+in
+{
+  containers.anonymousoverflow = {
+    autoStart = true;
+
+    # Simple veth connection between host and container
+    privateNetwork = true;
+    hostAddress    = "10.250.0.1";
+    localAddress   = "10.250.0.2";
+
+    # Rootfs is generated from this NixOS config:
+    config = { config, pkgs, ... }:
+
+      let
+        # 1) Fetch AnonymousOverflow source
+        anonymousOverflowSrc = pkgs.fetchFromGitHub {
+          owner  = "httpjamesm";
+          repo   = "AnonymousOverflow";
+          # Pin some tag or commit
+          rev    = "v1.13.0";
+          # TODO: replace with real hash after first build
+          sha256 = "sha256-hvcOJctvNswEws+cCoeGQSvFzZvnThhKk3fJ7TnNulY=";
+        };
+
+        # 2) Build the Go binary
+        anonymousOverflowPkg = pkgs.buildGoModule {
+          pname   = "anonymousoverflow";
+          version = "1.13.0";
+
+          src = anonymousOverflowSrc;
+
+          # repo root
+          subPackages = [ "." ];
+
+          # TODO: replace with real vendor hash after first build
+          vendorHash = "sha256-P3kUGFJhj/pTNeVTwtg4IqhoHBH9rROfkr+ZsrUtmdo=";
+        };
+      in
+      {
+        # Set this to match your host’s stateVersion
+        system.stateVersion = "24.11";
+
+        # Optional but nice: container firewall allowing port 80
+        networking.firewall.allowedTCPPorts = [ 80 ];
+
+        systemd.services.anonymousoverflow = {
+          description = "AnonymousOverflow StackOverflow frontend (container)";
+          wantedBy    = [ "multi-user.target" ];
+          after       = [ "network-online.target" ];
+          wants       = [ "network-online.target" ];
+
+          serviceConfig = {
+            # Runs as root in container; that’s fine here, it needs port 80
+            ExecStart = "${anonymousOverflowPkg}/bin/anonymousoverflow";
+
+            Restart = "always";
+            RestartSec = 3;
+          };
+        };
+
+        # If AO needs env vars / config, set them here:
+        # systemd.services.anonymousoverflow.serviceConfig.Environment = [
+        #   "PORT=80"
+        #   "BIND_ADDR=0.0.0.0"
+        # ];
+      };
+  };
+
+  #################################
+  ## Anubis in front of it       ##
+  #################################
+
+  services.anubis.instances.anonymousoverflow = {
+    enable = true;
+
+    settings = {
+      # Must use this prefix form: /run/anubis/anubis-<name>/...
+      BIND         = "/run/anubis/anubis-anonymousoverflow/anubis.sock";
+      METRICS_BIND = "/run/anubis/anubis-anonymousoverflow/metrics.sock";
+
+      # If you keep the default :8080:
+      # TARGET = "http://127.0.0.1:8080";
+
+      # If you configure the app to listen on 127.0.0.1:${upstreamPort}:
+      TARGET           = "http://10.250.0.2:${toString upstreamPort}";
+
+      SERVE_ROBOTS_TXT = true;
+    };
+  };
+
+  #################################
+  ## Caddy vhost                 ##
+  #################################
+
+  services.caddy.virtualHosts.${host}.extraConfig = ''
+    reverse_proxy unix//run/anubis/anubis-anonymousoverflow/anubis.sock
+  '';
+}