Berwn
46 lines
1.4 KiB
Nix
46 lines
1.4 KiB
Nix
# Infra runbook (mdBook), built at Nix-build time from ./docs and served by Caddy.
|
|
# Reachable only over the ZeroTier mesh (firewall rule below); the public side is
|
|
# already closed by the Hetzner cloud firewall. Imported by control only.
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
mesh = import ./mesh-hosts.nix { inherit config lib; };
|
|
port = 8080;
|
|
|
|
site = pkgs.stdenvNoCC.mkDerivation {
|
|
name = "cnx-infra-docs";
|
|
src = ../docs;
|
|
nativeBuildInputs = [ pkgs.mdbook ];
|
|
# mdbook writes a state dir under $HOME; the build sandbox has none.
|
|
buildPhase = ''
|
|
export HOME=$TMPDIR
|
|
mdbook build -d $out
|
|
'';
|
|
dontInstall = true;
|
|
};
|
|
in
|
|
{
|
|
# ":port" makes Caddy serve plain HTTP (no automatic TLS) on all interfaces;
|
|
# the mesh-scoped firewall rule below is what constrains reachability.
|
|
services.caddy = {
|
|
enable = true;
|
|
virtualHosts.":${toString port}".extraConfig = ''
|
|
root * ${site}
|
|
# mdBook doesn't fingerprint asset filenames, so a browser left to its own
|
|
# heuristics caches the HTML and serves stale docs after a redeploy. Force a
|
|
# conditional request on every load; file_server's ETag/Last-Modified makes
|
|
# the unchanged case a cheap 304 over the mesh.
|
|
header Cache-Control "no-cache"
|
|
file_server
|
|
'';
|
|
};
|
|
|
|
networking.firewall.extraInputRules = ''
|
|
ip6 saddr ${mesh.subnet} tcp dport ${toString port} accept
|
|
'';
|
|
}
|