cc-ci-orchestrator/nix/atproto-likes.nix

# atproto-likes — the "most-liked accounts" web UI, run as a docker-compose stack behind nginx.
#
# ⚠️  COPY. Canonical source:
#     /srv/project-orchestrator/projects/notplants-atproto/nix/atproto-likes.nix
#     A flake cannot import an absolute path outside its own tree under pure
#     evaluation, so the module is copied here. Re-copy after editing the original.
#
# Import this from the host configuration:
#   imports = [ /srv/project-orchestrator/projects/notplants-atproto/nix/atproto-likes.nix ];
#
# What it sets up:
#   * the Docker daemon (this host had none before)
#   * a systemd unit that builds and runs docker-compose.yml from the project checkout
#   * an nginx vhost for atproto.commoninternet.net with a Let's Encrypt cert,
#     proxying to the container on 127.0.0.1:8731
#   * ports 80/443 open (they were closed — only 22 was public)
#
# DNS: atproto.commoninternet.net resolves to 143.244.213.108 — the operator's
# gateway (tailnet peer `gateway-server-aug2-9pm`, 100.80.66.110), which fronts this
# host rather than pointing at it directly. So what arrives here is the gateway's
# back-end hop, and the gateway needs a route for this hostname to either
#     http://100.84.190.30       (tailnet, preferred)
#     http://168.119.126.100     (public)
# preserving the Host header, passing Upgrade/Connection through (the loading page
# is a websocket), and allowing a long read timeout (a cold scan runs minutes).
# ACME here can only succeed if the gateway forwards /.well-known/acme-challenge/;
# otherwise the gateway should own the certificate and `enableACME` can go false.
{ config, pkgs, lib, ... }:

let
  projectDir = "/srv/project-orchestrator/projects/notplants-atproto";
  domain = "atproto.commoninternet.net";
  hostPort = 8731;                        # must match the ports: mapping in docker-compose.yml
  compose = "${pkgs.docker-compose}/bin/docker-compose";
in
{
  virtualisation.docker = {
    enable = true;
    # Reclaim dangling images from repeated `--build` runs.
    autoPrune = { enable = true; dates = "weekly"; };
  };

  # Build + run the compose stack. Type=oneshot with RemainAfterExit: compose
  # detaches, and the containers' own restart policy keeps them alive.
  systemd.services.atproto-likes = {
    description = "atproto-likes — most-liked-accounts web UI (docker compose)";
    wantedBy = [ "multi-user.target" ];
    after = [ "docker.service" "docker.socket" "network-online.target" ];
    requires = [ "docker.service" ];
    wants = [ "network-online.target" ];
    path = [ pkgs.docker pkgs.docker-compose ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      WorkingDirectory = projectDir;
      # A cold `--build` pulls python:3.12-slim and installs pip deps.
      TimeoutStartSec = "1800";
      ExecStart = "${compose} up -d --build --remove-orphans";
      ExecStop = "${compose} down";
      Restart = "on-failure";
      RestartSec = "30s";
    };
  };

  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    virtualHosts.${domain} = {
      # addSSL, NOT forceSSL. DNS for this domain points at the gateway
      # (143.244.213.108), which fronts this host — so the request that actually
      # arrives here is the gateway's back-end hop. If that hop is plain HTTP and
      # we answered with a 301 to https://atproto.commoninternet.net/, it would
      # resolve straight back to the gateway: a redirect loop. Serve both schemes
      # and let the gateway decide where TLS terminates.
      addSSL = true;
      # Keeps retrying; it can only succeed if the gateway forwards
      # /.well-known/acme-challenge/ here, since the A record is the gateway's.
      # Until then nginx uses the self-signed placeholder NixOS installs, and the
      # acme-atproto… unit sits in `failed`. Set this false if the gateway is to
      # own the certificate permanently.
      enableACME = true;
      # The `oc.commoninternet.net` vhost binds explicitly to the tailscale IP on
      # port 80. nginx prefers the most specific listen address, so a request to
      # 100.84.190.30:80 was only ever matched against THAT server block — this
      # vhost, listening on 0.0.0.0, never got a look in, and a gateway hop over
      # the tailnet was served the opencode UI instead. Listing the tailscale
      # address explicitly here puts both vhosts on that socket, so server_name
      # decides, which is what we want.
      listen = [
        { addr = "0.0.0.0";        port = 80;  ssl = false; }
        { addr = "0.0.0.0";        port = 443; ssl = true;  }
        { addr = "100.84.190.30";  port = 80;  ssl = false; }
        { addr = "100.84.190.30";  port = 443; ssl = true;  }
      ];
      locations."/" = {
        proxyPass = "http://127.0.0.1:${toString hostPort}";
        # The loading page streams scan progress over a websocket.
        proxyWebsockets = true;
        # A cold scan can run for minutes with the socket open; the default 60s
        # proxy read timeout would cut the loading page off mid-flower.
        extraConfig = ''
          proxy_read_timeout 1800s;
          proxy_send_timeout 1800s;
        '';
      };
    };
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "mfowler.email@protonmail.com";
  };

  # Public HTTP/HTTPS. Before this, only 22 was open on the public interface.
  networking.firewall.allowedTCPPorts = [ 80 443 ];
}