nix

commit c6dbb6a4037f23b757dc090048db15b01ff3df2c
parent 13ea08c4da60bd6e3bf7fa966e6d46b1e85b5083
Author: mtmn <miro@haravara.org>
Date:   Tue, 28 Apr 2026 22:59:37 +0200

radicle: init on `nixaran`

Diffstat:
M
hosts/nixaran/configuration.nix
 | 
0

A
modules/services/radicle-node.nix
 | 
83
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
M
secrets.nix
 | 
1
+
A
secrets/radicle-node-key.age
 | 
0

4 files changed, 84 insertions(+), 0 deletions(-)
diff --git a/hosts/nixaran/configuration.nix b/hosts/nixaran/configuration.nix
Binary files differ.
diff --git a/modules/services/radicle-node.nix b/modules/services/radicle-node.nix
@@ -0,0 +1,83 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.services.haravara.radicle-node;
+in {
+  options.services.haravara.radicle-node = {
+    enable = lib.mkEnableOption "Radicle seed node";
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      description = "Public domain name for the seed node (used as alias and external address)";
+      example = "seed.haravara.org";
+    };
+
+    publicKey = lib.mkOption {
+      type = lib.types.str;
+      description = "SSH public key string for the Radicle node identity (without comment field)";
+      example = "ssh-ed25519 AAAA...";
+    };
+
+    privateKeyFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to the SSH private key file (e.g. an age-decrypted secret)";
+    };
+
+    openFirewall = lib.mkEnableOption "opening the firewall for radicle-node (port 8776)";
+
+    settings = lib.mkOption {
+      type = lib.types.attrs;
+      default = {};
+      description = "Additional settings merged into services.radicle.settings";
+    };
+
+    httpd = {
+      enable = lib.mkEnableOption "Radicle HTTP gateway (radicle-httpd) behind Caddy";
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 8080;
+        description = "Internal listen port for radicle-httpd";
+      };
+
+      aliases = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = {};
+        description = "Alias-to-RID pairs for short clone URLs";
+        example = lib.literalExpression ''{ heartwood = "rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5"; }'';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.radicle = {
+      enable = true;
+      inherit (cfg) publicKey;
+      privateKey = cfg.privateKeyFile;
+      node = {
+        inherit (cfg) openFirewall;
+      };
+      settings = lib.mkMerge [
+        {
+          node.alias = cfg.domain;
+          node.externalAddresses = ["${cfg.domain}:8776"];
+        }
+        cfg.settings
+      ];
+      httpd = lib.mkIf cfg.httpd.enable {
+        enable = true;
+        listenAddress = "127.0.0.1";
+        listenPort = cfg.httpd.port;
+        inherit (cfg.httpd) aliases;
+      };
+    };
+
+    services.caddy.virtualHosts."${cfg.domain}" = lib.mkIf cfg.httpd.enable {
+      extraConfig = ''
+        reverse_proxy 127.0.0.1:${toString cfg.httpd.port}
+      '';
+    };
+  };
+}
diff --git a/secrets.nix b/secrets.nix
@@ -20,4 +20,5 @@ in {
   "secrets/smtp-alerts-password.age".publicKeys = allKeys;
   "secrets/radicale-htpasswd.age".publicKeys = allKeys;
   "secrets/shirt-linkener-auth-token.age".publicKeys = allKeys;
+  "secrets/radicle-node-key.age".publicKeys = allKeys;
 }
diff --git a/secrets/radicle-node-key.age b/secrets/radicle-node-key.age
Binary files differ.