nix

commit 6b4b0fabdd020bfdd8c4918f5fe4fb22846be210
parent 3cdba189376aba0d956d679843b4962891dfa0e8
Author: mtmn <miro@haravara.org>
Date:   Sat, 27 Jun 2026 22:45:55 +0200

add extra dns to headscale, dex headers, etc.

Diffstat:
M
hosts/nixaran/configuration.nix
 | 
0

A
modules/mixins/stagit/fred.png
 | 
0

M
modules/services/dex.nix
 | 
17
++++++++---------
M
modules/services/headscale.nix
 | 
6
++++++
M
modules/services/stagit.nix
 | 
46
++++++++++++++++++++++++++++++++++++++++++----

5 files changed, 56 insertions(+), 13 deletions(-)
diff --git a/hosts/nixaran/configuration.nix b/hosts/nixaran/configuration.nix
Binary files differ.
diff --git a/modules/mixins/stagit/fred.png b/modules/mixins/stagit/fred.png
Binary files differ.
diff --git a/modules/services/dex.nix b/modules/services/dex.nix
@@ -100,16 +100,15 @@ in {
     };
 
     services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
-      header {
-        Strict-Transport-Security "max-age=31536000; includeSubDomains"
-        X-Content-Type-Options "nosniff"
-        X-Frame-Options "DENY"
-        Referrer-Policy "strict-origin-when-cross-origin"
-        Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'"
-        -Server
-      }
+            header {
+              Strict-Transport-Security "max-age=31536000; includeSubDomains"
+              X-Content-Type-Options "nosniff"
+              X-Frame-Options "DENY"
+              Referrer-Policy "strict-origin-when-cross-origin"
+      -Server
+            }
 
-      reverse_proxy ${cfg.address}
+            reverse_proxy ${cfg.address}
     '';
   };
 }
diff --git a/modules/services/headscale.nix b/modules/services/headscale.nix
@@ -29,6 +29,11 @@ in {
       default = 8085;
       description = "The port for the Headscale instance";
     };
+    extraDnsRecords = lib.mkOption {
+      type = lib.types.listOf (lib.types.attrsOf lib.types.str);
+      default = [];
+      description = "Extra DNS records to push to all tailnet clients";
+    };
     derp = {
       enable = lib.mkEnableOption "embedded DERP relay server";
       stunPort = lib.mkOption {
@@ -64,6 +69,7 @@ in {
             "1.1.1.1"
             "8.8.8.8"
           ];
+          extra_records = cfg.extraDnsRecords;
         };
         ip_prefixes = [
           "100.64.0.0/10"
diff --git a/modules/services/stagit.nix b/modules/services/stagit.nix
@@ -16,6 +16,18 @@
   excludeDirPattern = lib.concatMapStringsSep "|" (r: "${r}.git") excludeNames;
   excludeNamePattern = lib.concatStringsSep "|" excludeNames;
 
+  applyRepoMeta = lib.concatStrings (lib.mapAttrsToList (name: meta: ''
+      if [ -d "${reposDir}/${name}.git" ]; then
+        ${lib.optionalString (meta.description != null) ''
+        printf '%s' ${lib.escapeShellArg meta.description} > "${reposDir}/${name}.git/description"
+      ''}
+        ${lib.optionalString (meta.owner != null) ''
+        git -C "${reposDir}/${name}.git" config gitweb.owner ${lib.escapeShellArg meta.owner}
+      ''}
+      fi
+    '')
+    cfg.repos);
+
   preamble = ''
     export LC_CTYPE="C.UTF-8"
     umask 022
@@ -25,9 +37,11 @@
     cloneurl="ssh://${gitoliteUser}@${cfg.domain}:${toString cfg.sshPort}"
 
     mkdir -p "$htmldir"
-    install -m644 "${assets}/style.css"   "$htmldir/style.css"
-    install -m644 "${assets}/logo.png"    "$htmldir/logo.png"
-    install -m644 "${assets}/favicon.png" "$htmldir/favicon.png"
+    install -m644 "${assets}/style.css" "$htmldir/style.css"
+    # Hide owner field as i am the only user
+    echo '#index tr > *:nth-child(3) { display: none; }' >> "$htmldir/style.css"
+    install -m644 "${../mixins/stagit/fred.png}" "$htmldir/logo.png"
+    install -m644 "${../mixins/stagit/fred.png}" "$htmldir/favicon.png"
 
     set --
     for dir in "$reposdir"/*.git; do
@@ -58,6 +72,7 @@
     runtimeInputs = [pkgs.stagit pkgs.git pkgs.coreutils];
     text = ''
       ${preamble}
+      ${applyRepoMeta}
       ${render_repo}
 
       stagit-index "$@" > "$htmldir/index.html"
@@ -72,6 +87,7 @@
     runtimeInputs = [pkgs.stagit pkgs.git pkgs.coreutils];
     text = ''
       ${preamble}
+      ${applyRepoMeta}
       ${render_repo}
 
       name=$(basename "$(pwd)")
@@ -121,7 +137,29 @@ in {
     excludeRepos = lib.mkOption {
       type = lib.types.listOf lib.types.str;
       default = [];
-      example = ["secret-notes" "wip"];
+      example = ["admin" "internal"];
+    };
+
+    repos = lib.mkOption {
+      default = {};
+      example = {
+        myrepo = {
+          description = "";
+          owner = "miro";
+        };
+      };
+      type = lib.types.attrsOf (lib.types.submodule {
+        options = {
+          description = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+          owner = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+        };
+      });
     };
 
     adminPubkey = lib.mkOption {