-
diff --git a/module.nix b/module.nix
index 7eecb7a..940fd73 100644
--- a/module.nix
+++ b/module.nix
@@ -16,6 +16,8 @@ in
description = "Domain to serve the website on.";
};
+ tor.enable = lib.mkEnableOption "Tor hidden service for the website";
+
envFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
@@ -36,6 +38,55 @@ in
};
config = lib.mkIf cfg.enable {
+ age.secrets.webhook-secret = {
+ file = "${self}/secrets/webhook-secret.age";
+ mode = "0400";
+ };
+
+ age.secrets.tor-onion-secret-key = lib.mkIf cfg.tor.enable {
+ file = "${self}/secrets/tor-onion-secret-key.age";
+ owner = "tor";
+ group = "tor";
+ mode = "0400";
+ };
+ age.secrets.tor-onion-public-key = lib.mkIf cfg.tor.enable {
+ file = "${self}/secrets/tor-onion-public-key.age";
+ owner = "tor";
+ group = "tor";
+ mode = "0444";
+ };
+ age.secrets.tor-onion-hostname = lib.mkIf cfg.tor.enable {
+ file = "${self}/secrets/tor-onion-hostname.age";
+ owner = "tor";
+ group = "tor";
+ mode = "0444";
+ };
+
+ services.tor = lib.mkIf cfg.tor.enable {
+ enable = true;
+ relay.onionServices.jetpham-website = {
+ map = [{ port = 80; target = { addr = "127.0.0.1"; port = 8888; }; }];
+ };
+ };
+
+ systemd.services.tor-onion-keys = lib.mkIf cfg.tor.enable {
+ description = "Copy Tor onion keys into place";
+ after = [ "agenix.service" ];
+ before = [ "tor.service" ];
+ wantedBy = [ "tor.service" ];
+ serviceConfig.Type = "oneshot";
+ script = ''
+ dir="/var/lib/tor/onion/jetpham-website"
+ mkdir -p "$dir"
+ cp ${config.age.secrets.tor-onion-secret-key.path} "$dir/hs_ed25519_secret_key"
+ cp ${config.age.secrets.tor-onion-public-key.path} "$dir/hs_ed25519_public_key"
+ cp ${config.age.secrets.tor-onion-hostname.path} "$dir/hostname"
+ chown -R tor:tor "$dir"
+ chmod 700 "$dir"
+ chmod 400 "$dir/hs_ed25519_secret_key"
+ chmod 444 "$dir/hs_ed25519_public_key" "$dir/hostname"
+ '';
+ };
# Q&A API systemd service
systemd.services.jetpham-qa-api = {
description = "Jet Pham Q&A API";
@@ -47,14 +98,11 @@ in
Environment = [ "QA_DB_PATH=/var/lib/jetpham-qa/qa.db" ];
Restart = "on-failure";
RestartSec = 5;
- } // lib.optionalAttrs (cfg.webhookSecretFile == null) {
- ExecStart = "${qaApi}/bin/jetpham-qa-api";
+ LoadCredential = "webhook-secret:${config.age.secrets.webhook-secret.path}";
} // lib.optionalAttrs (cfg.envFile != null) {
EnvironmentFile = cfg.envFile;
- } // lib.optionalAttrs (cfg.webhookSecretFile != null) {
- LoadCredential = "webhook-secret:${cfg.webhookSecretFile}";
};
- script = lib.mkIf (cfg.webhookSecretFile != null) ''
+ script = ''
export WEBHOOK_SECRET="$(cat $CREDENTIALS_DIRECTORY/webhook-secret)"
exec ${qaApi}/bin/jetpham-qa-api
'';
@@ -76,5 +124,22 @@ in
}
'';
};
+
+ services.caddy.virtualHosts."http://127.0.0.1:8888" = lib.mkIf cfg.tor.enable {
+ extraConfig = ''
+ header Cross-Origin-Opener-Policy "same-origin"
+ header Cross-Origin-Embedder-Policy "require-corp"
+
+ handle /api/* {
+ reverse_proxy 127.0.0.1:3001
+ }
+
+ handle {
+ root * ${package}
+ try_files {path} /index.html
+ file_server
+ }
+ '';
+ };
};
}
diff --git a/secrets.nix b/secrets.nix
new file mode 100644
index 0000000..6eb198a
--- /dev/null
+++ b/secrets.nix
@@ -0,0 +1,10 @@
+let
+ laptop = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE40ISu3ydCqfdpb26JYD5cIN0Fu0id/FDS+xjB5zpqu";
+ server = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAING219cDKTDLaZefmqvOHfXvYloA/ErsCGE0pM022vlB";
+in
+{
+ "secrets/tor-onion-secret-key.age".publicKeys = [ laptop server ];
+ "secrets/tor-onion-public-key.age".publicKeys = [ laptop server ];
+ "secrets/tor-onion-hostname.age".publicKeys = [ laptop server ];
+ "secrets/webhook-secret.age".publicKeys = [ laptop server ];
+}
diff --git a/secrets/tor-onion-hostname.age b/secrets/tor-onion-hostname.age
new file mode 100644
index 0000000..45ef5e8
Binary files /dev/null and b/secrets/tor-onion-hostname.age differ
diff --git a/secrets/tor-onion-public-key.age b/secrets/tor-onion-public-key.age
new file mode 100644
index 0000000..cd674b3
--- /dev/null
+++ b/secrets/tor-onion-public-key.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 Ziw7aw 2u0CVE/rQWpJNSRW/1xeWBKpShWT4ckke+Ih4j3WbRk
+xeE2xTlSPEDPeC4BNkaSoOckwuOhyCQWqtXkwuhBiRo
+-> ssh-ed25519 uKftJg Tt1mbTWHyXRDjvGWFBqmyrMl/PtUs45N1032luY88x8
+A51wD3tiZ0lV1TSub+Pz7hZ+kndiEpnmBliP59qYzkY
+--- 7X+mgLxb3uYfiYebJnAUwl/4jhGJJSweaolMttmoEIQ
+3.u˼Z"9֍'AK~.@̉7lWp{CA&@|˚V%55 Otr9hL@GLg
\ No newline at end of file
diff --git a/secrets/tor-onion-secret-key.age b/secrets/tor-onion-secret-key.age
new file mode 100644
index 0000000..4e28af1
--- /dev/null
+++ b/secrets/tor-onion-secret-key.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 Ziw7aw AZTbqWYmTaudHZ8PiTZlwpf7VzwaP921guVV1iQi8WM
+7CGUyEjZoAPCBX2pqNHLd2P1KLnj/Y5nnBVToWYCjWg
+-> ssh-ed25519 uKftJg RfAkte/jcx+/SvZiUNH07cnBJcvl0Sjt7zSxdSCsXE0
+TdMsQ2u5WXw3KAi7Tk4JOdbiFStT8F88xjDlRN8LH2Q
+--- pgQnGRRVjVK02tbMgDoh3SatJFxxFLazqy5ieHu96tk
+x}TSP^kH
/ݳU~k;֕Ն=N\PZ|O/Y V6x=
H
\ No newline at end of file
diff --git a/secrets/webhook-secret.age b/secrets/webhook-secret.age
new file mode 100644
index 0000000..b40ad99
--- /dev/null
+++ b/secrets/webhook-secret.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 Ziw7aw zDI2q+wM70YbQFw7hEQbU58XrgkWnM8fura+ovG0bTw
+0Aznts9gOT8ADxFY0SIv/VT0ExEEq9wZLTnlC0j15JU
+-> ssh-ed25519 uKftJg dFQxnrMwQHJ2lVBMi6P4XugljREjAHPV9bEFmLhuiBc
+VWKLaM3peiELoJigapdZv0N4Z4lRZZ8eGMEFy+WtdxA
+--- zJghsuTUoVH8bKynqq29kzEuNDuEjvFf5v/s98jQdaA
++iV2 *HФƀ c
\ No newline at end of file
diff --git a/src/main.ts b/src/main.ts
index 4bb48e6..55c70e7 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -2,14 +2,10 @@ import "~/styles/globals.css";
import init, { start } from "cgol";
import { route, initRouter } from "~/router";
import { homePage } from "~/pages/home";
-import { projectsPage } from "~/pages/projects";
-import { projectPage } from "~/pages/project";
import { qaPage } from "~/pages/qa";
import { notFoundPage } from "~/pages/not-found";
route("/", homePage);
-route("/projects", projectsPage);
-route("/projects/:slug", projectPage);
route("/qa", qaPage);
route("*", notFoundPage);
diff --git a/src/pages/qa.ts b/src/pages/qa.ts
index 9cbda4c..190b4ca 100644
--- a/src/pages/qa.ts
+++ b/src/pages/qa.ts
@@ -11,14 +11,13 @@ export async function qaPage(outlet: HTMLElement) {
outlet.innerHTML = `