Revert changes

nix-system-configs/modules/styling/forgejo/Jost/LICENSE.md

@@ -0,0 +1,79 @@
+SIL OPEN FONT LICENSE
+=====================
+
+Version 1.1 - 26 February 2007
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting — in part or in whole — any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+4) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

nix-system-configs/modules/styling/forgejo/header.tmpl

@@ -8,8 +8,19 @@
   font-display: swap;
 }
 
+@font-face {
+  font-family: 'Jost Book';
+  src: url('/assets/fonts/Jost-400-Book.otf') format('opentype');
+  font-weight: normal;
+  font-style: normal;
+  font-display: swap;
+}
+
+
 :root {
+  /* prefer the Maple Mono Nerd Font for monospace usage */
   --fonts-monospace: 'Maple Mono NF' !important;
+  --fonts-proportional: 'Jost Book' !important;
 }
 
 code, pre, kbd, tt, samp, .ui code, .ui pre, .monospace {

nix-system-configs/modules/styling/forgejo/home.tmpl

@@ -1,13 +0,0 @@
-{{template "base/head" .}}
-<div role="main" aria-label='{{if .IsSigned}}{{.Ctx.Locale.Tr "dashboard"}}{{else}}{{.Ctx.Locale.Tr "home"}}{{end}}' class="page-content home">
-	<div class="tw-mb-8 tw-px-8">
-		<div class="center">
-			<div class="hero">
-				<h1 class="ui icon header title">
-					Forgejo hosted on NixOS!
-				</h1>
-			</div>
-		</div>
-	</div>
-</div>
-{{template "base/footer" .}}

nix-system-configs/modules/styling/forgejo/theme-custom.css

@@ -7,10 +7,26 @@
   font-display: swap;
 }
 
+@font-face {
+  font-family: 'Jost Book';
+  src: url('/assets/fonts/Jost-400-Book.otf') format('opentype');
+  font-weight: normal;
+  font-style: normal;
+  font-display: swap;
+}
+
 /* import base Forgejo theme so we only override what we need */
 @import "./theme-forgejo-auto.css";
 
 :root {
   /* prefer the Maple Mono Nerd Font for monospace usage */
   --fonts-monospace: 'Maple Mono NF' !important;
+  --fonts-proportional: 'Jost Book' !important;
 }
+
+/* If some odd reason the themes are not appluing even after rebuild, try the following
+sudo systemd-tmpfiles --create --remove --exclude-prefix=/dev
+sudo systemctl restart forgejo
+
+TODO: Investigate the inconsistencies, see header.tmpl as a workaround.
+ */

nix-system-configs/modules/system/forgejo.nix

@@ -25,6 +25,13 @@
     mkdir -p $out/fonts
     cp "$f" $out/fonts/MapleMonoNerd.ttf
   '';
+
+  # Package local Jost OTF files from the repository into the Nix store so
+  # they can be installed into the Forgejo custom assets directory.
+  jostFonts = pkgs.runCommand "jost-fonts" {src = ../styling/forgejo/Jost/OpenType;} ''
+    mkdir -p $out/fonts
+    cp -a $src/*.otf $out/fonts/
+  '';
 in {
   options.local = {
     hostname = lib.mkOption {
@@ -116,9 +123,9 @@ in {
         };
 
         # Optional: Email configuration
-        # mailer = {
-        #   ENABLED = false;
-        # };
+        mailer = {
+          ENABLED = false;
+        };
       };
 
       settings.ui = {
@@ -137,19 +144,32 @@ in {
       "d '${config.services.forgejo.customDir}/public/assets/fonts' - forgejo forgejo - -"
       # ensure css directory exists so we can place theme css
       "d '${config.services.forgejo.customDir}/public/assets/css' - forgejo forgejo - -"
+      # ensure image directory exists for site/app logos
+      "d '${config.services.forgejo.customDir}/public/assets/img' - forgejo forgejo - -"
       # install the TTF from the Nix store into the Forgejo customDir
       "C+ '${config.services.forgejo.customDir}/public/assets/fonts/MapleMonoNerd.ttf' - forgejo forgejo - ${mapleFonts}/fonts/MapleMonoNerd.ttf"
-      "C+ '${config.services.forgejo.customDir}/templates/home.tmpl' - forgejo forgejo - ${
-        ../styling/forgejo/home.tmpl
-      }"
-      # copy header.tmpl into templates/custom so we can inject custom CSS into the <head>
-      "C+ '${config.services.forgejo.customDir}/templates/custom/header.tmpl' - forgejo forgejo - ${
-        ../styling/forgejo/header.tmpl
-      }"
-      # copy your theme CSS into the public assets so Forgejo serves it directly
-      "C+ '${config.services.forgejo.customDir}/public/assets/css/theme-custom.css' - forgejo forgejo - ${
-        ../styling/forgejo/theme-custom.css
-      }"
+      # copy Jost OTF files from the Nix store into Forgejo's fonts dir (add one line per font present in the repo)
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-100-Hairline.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-100-Hairline.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-100-HairlineItalic.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-100-HairlineItalic.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-200-Thin.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-200-Thin.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-200-ThinItalic.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-200-ThinItalic.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-300-Light.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-300-Light.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-300-LightItalic.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-300-LightItalic.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-400-Book.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-400-Book.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-400-BookItalic.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-400-BookItalic.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-500-Medium.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-500-Medium.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-500-MediumItalic.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-500-MediumItalic.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-600-Semi.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-600-Semi.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-600-SemiItalic.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-600-SemiItalic.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-700-Bold.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-700-Bold.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-700-BoldItalic.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-700-BoldItalic.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-800-Hevy.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-800-Hevy.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-800-HevyItalic.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-800-HevyItalic.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-900-Black.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-900-Black.otf"
+      "C+ '${config.services.forgejo.customDir}/public/assets/fonts/Jost-900-BlackItalic.otf' - forgejo forgejo - ${jostFonts}/fonts/Jost-900-BlackItalic.otf"
+      # copy site/app logo files into Forgejo's public assets img folder
+      "C+ '${config.services.forgejo.customDir}/public/assets/img/logo.svg' - forgejo forgejo - ${toString ../styling/PRG_logo.svg}"
+      "C+ '${config.services.forgejo.customDir}/public/assets/img/logo.png' - forgejo forgejo - ${toString ../styling/PRG_logo.png}"
     ];
 
     # Fallback: one-shot systemd service to copy custom assets on activation (works even if tmpfiles isn't applied or for live testing)
@@ -159,14 +179,17 @@ in {
       serviceConfig = {
         Type = "oneshot";
         # Use bash -c to run a compact copy/install script that ensures dirs exist and files are owned by forgejo
+        #           cp -a ${toString ../styling/forgejo/home.tmpl} ${config.services.forgejo.customDir}/templates/home.tmpl; \
         ExecStart = ''          ${pkgs.bash}/bin/bash -c "set -eu; \
                     install -d -m0755 -o forgejo -g forgejo ${config.services.forgejo.customDir}/public/assets/fonts; \
                     install -d -m0755 -o forgejo -g forgejo ${config.services.forgejo.customDir}/public/assets/css; \
                     install -d -m0755 -o forgejo -g forgejo ${config.services.forgejo.customDir}/templates/custom; \
                     cp -a ${mapleFonts}/fonts/MapleMonoNerd.ttf ${config.services.forgejo.customDir}/public/assets/fonts/MapleMonoNerd.ttf; \
                     cp -a ${toString ../styling/forgejo/header.tmpl} ${config.services.forgejo.customDir}/templates/custom/header.tmpl; \
-          cp -a ${toString ../styling/forgejo/home.tmpl} ${config.services.forgejo.customDir}/templates/home.tmpl; \
                     cp -a ${toString ../styling/forgejo/theme-custom.css} ${config.services.forgejo.customDir}/public/assets/css/theme-custom.css; \
+                    cp -a ${jostFonts}/fonts/* ${config.services.forgejo.customDir}/public/assets/fonts/ || true; \
+                    cp -a ${toString ../styling/PRG_logo.svg} ${config.services.forgejo.customDir}/public/assets/img/logo.svg || true; \
+                    cp -a ${toString ../styling/PRG_logo.png} ${config.services.forgejo.customDir}/public/assets/img/logo.png || true; \
                     chown -R forgejo:forgejo ${config.services.forgejo.customDir}"'';
       };
       wantedBy = ["multi-user.target"];

nix-system-configs/modules/system/traefik.nix

@@ -44,6 +44,92 @@ in {
     local.userDescription = "NixOS PRG Traefik Service";
     local.address = "10.1.1.250";
 
+    # Configure Anubis service
+    services.anubis = {
+      instances = {
+        "" = {
+          enable = true;
+          settings = {
+            # Bind to TCP instead of Unix socket for Docker-style integration
+            BIND_NETWORK = "tcp";
+            BIND = "127.0.0.1:8090";
+
+            # Empty TARGET for redirect mode
+            TARGET = " ";
+
+            # Configure redirect domains - ALL domains that should be able to redirect back after challenge
+            REDIRECT_DOMAINS = "prg-radio.org,git.prg-radio.org,wavelog.prg-radio.org,partdb.prg-radio.org,anubis.prg-radio.org";
+
+            # Public URL for Anubis
+            PUBLIC_URL = "https://anubis.prg-radio.org";
+
+            # Cookie domain for proper scoping (leading dot for all subdomains)
+            COOKIE_DOMAIN = ".prg-radio.org";
+
+            # Difficulty level
+            DIFFICULTY = 7;
+            #ALGOTIHM = "slow";
+
+            # Optional: serve robots.txt
+            SERVE_ROBOTS_TXT = true;
+
+            # Optional: webmaster email for error pages
+            WEBMASTER_EMAIL = "dtu.prg@gmail.com";
+
+            # Metrics on separate port
+            METRICS_BIND_NETWORK = "tcp";
+            METRICS_BIND = "127.0.0.1:8091";
+          };
+        };
+
+        # Per-service Anubis instances (reverse-proxy mode) ---------------------------
+        forgejo = {
+          enable = true;
+          settings = {
+            BIND_NETWORK = "tcp";
+            BIND = "127.0.0.1:8092";
+            TARGET = "http://10.1.1.4:3000"; # Forgejo backend
+            DIFFICULTY = 20;
+            SERVE_ROBOTS_TXT = true;
+            WEBMASTER_EMAIL = "dtu.prg@gmail.com";
+            METRICS_BIND_NETWORK = "tcp";
+            METRICS_BIND = "127.0.0.1:8095";
+          };
+        };
+
+        /*
+        wavelog = {
+          enable = true;
+          settings = {
+            BIND_NETWORK = "tcp";
+            BIND = "127.0.0.1:8093";
+            TARGET = "http://10.1.1.249:8086"; # Wavelog backend
+            DIFFICULTY = 20;
+            SERVE_ROBOTS_TXT = true;
+            WEBMASTER_EMAIL = "dtu.prg@gmail.com";
+            METRICS_BIND_NETWORK = "tcp";
+            METRICS_BIND = "127.0.0.1:8096";
+          };
+        };
+        */
+
+        # This part needs investigating
+        partdb = {
+          enable = true;
+          settings = {
+            BIND_NETWORK = "tcp";
+            BIND = "127.0.0.1:8094";
+            TARGET = "http://10.1.1.249:8087"; # PartDB backend
+            DIFFICULTY = 20;
+            SERVE_ROBOTS_TXT = true;
+            WEBMASTER_EMAIL = "dtu.prg@gmail.com";
+            METRICS_BIND_NETWORK = "tcp";
+            METRICS_BIND = "127.0.0.1:8097";
+          };
+        };
+      };
+    };
+
     services.traefik = {
       enable = true;
       group = "acme";
@@ -103,13 +189,32 @@ in {
             keyFile = "/var/lib/acme/prg-radio.org/key.pem";
           }
         ];
+
         http.routers = {
+          #anubis-api = {
+          #  rule = "Host(`anubis.prg-radio.org`) && PathPrefix(`/.within.website/x/cmd/anubis/api`)";
+          #  service = "anubis";
+          #   entryPoints = ["websecure"];
+          #  priority = 200;
+          #   tls = {};
+          # };
+
+          # Anubis router (for challenge page)
+          anubis = {
+            rule = "Host(`anubis.prg-radio.org`)";
+            service = "anubis";
+            entryPoints = ["websecure"];
+            tls = {};
+          };
+
+          # Protected service example: Forgejo
           forgejo = {
             rule = "Host(`git.prg-radio.org`)";
             service = "forgejo";
             entryPoints = ["websecure"];
             tls = {};
           };
+
           # Matrix HTTP router for client requests (Element etc.)
           matrix = {
             rule = "Host(`lgbtq.prg-radio.org`)";
@@ -117,6 +222,8 @@ in {
             entryPoints = ["websecure"];
             tls = {};
           };
+
+          # Protected service: Wavelog
           wavelog = {
             rule = "Host(`wavelog.prg-radio.org`)";
             service = "wavelog";
@@ -124,6 +231,7 @@ in {
             tls = {};
           };
 
+          # Protected service: PartDB
           partdb = {
             rule = "Host(`partdb.prg-radio.org`)";
             service = "partdb";
@@ -131,10 +239,19 @@ in {
             tls = {};
           };
         };
+
         http.services = {
+          # Anubis service (challenge UI / redirect endpoint)
+          anubis.loadBalancer = {
+            servers = [
+              {url = "http://127.0.0.1:8090";}
+            ];
+            #passHostHeader = true;
+          };
+
           forgejo.loadBalancer = {
             servers = [
-              {url = "http://10.1.1.4:3000";}
+              {url = "http://127.0.0.1:8092";}
             ];
           };
           matrix.loadBalancer = {
@@ -150,7 +267,7 @@ in {
 
           partdb.loadBalancer = {
             servers = [
-              {url = "http://10.1.1.249:8087";}
+              {url = "http://127.0.0.1:8094";}
             ];
           };
         };