site: finish setup

hosts/thegeneralist-central/cert.pem.age

@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 pp9qdQ 2WgjmfKlFjtkMRuA1pHNaGDoGKUozBBjYosmfSNL8EA
+dbFwrLcgWUaxKkHPGsGF7OaOXb3xf5nsCdGhnkbkzPU
+--- yCk7ScptYN12uv1aCqyqfqRHvxl8QiAaFRXd3KgJbdE
+èn­gDÊÎ~ÿ·GÛ÷¦¢èþ‚âât%ó­uá÷÷©¦—1ãg<C3A3> UÖ¥zL<7A>ÖY|ÓŸ¾añr¹o\©èBs8@kê~Ar†To£þ÷%zžÀ²—yƒ¨ë|"ÿ™‡`CÁjw·ºõŠ¨ñ5±>‡lû¼ÂeèºFœy<C593>ÃfEìÁ·éZÉó½
êUÃÅ:|H <1B>Š“¸=è¨u¥ñˆÂÑ© þ(ÈÀ^qÙ‡Œoï˜ô=‰<>ûï<C3BB>q3Œ×b<C397>I­	äìA¹ð›ýn¹`<60>HÓksGj
+:…ÐM¨¥˜X·`ßolÄçéÙ‡etddÁoÊÉö¬ÍÑóPíüFï§~‡ôƒÕ¥Úÿ#9*M,hþÑ­Zjo›”Øo|ª"­Ïe$©ÏÙ0ºV

hosts/thegeneralist-central/cftoken.age

@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 pp9qdQ OrqCuVIzHaavNZxpOXYlIcnrHJe5GOjtcIhmaw+8wHI
+TQCYrhgm4O52QPodgSmFMvyw0Ln7n/+vFlGnONctPKk
+--- jOnFOfG4YRnpvtmmoEVfbh3mAXtfcJiTjzja46xTKMk
+Ï÷r_z'Dx<44>’y2Ô—ÿƒG½8¹hë}=è‡EàK«[wÀßÆìöaðÿBÞ
+÷þH ħÿHîÆbE–ÿì9{´YS‚ÑΖJÞL>²ö¨êPÈÒ“m£ÿDšn¤BQ
Qšš2êÕ¸·çW&uÒ‡X…¼òf»FUoj6Q3e4¡X¸*‚Ý*ó*xÚÓÖ½©ç Cî±ÏýpÇ’}”ÛVµ9~
=û`ô ½¦<C2BD>’AÓI<.÷’GEÀ¨2­L1BM‡x›ÿW…½IlŸ–†Ü}2&±âïÖ

hosts/thegeneralist-central/configuration.nix

@@ -5,7 +5,7 @@
 { self, config, pkgs, lib, inputs, ... }:
 
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [ ./hardware-configuration.nix ./site.nix ];
 
   users.users.thegeneralist = {
     isNormalUser = true;
@@ -18,7 +18,6 @@
     in [ thegeneralist ];
   };
 
-  programs.home-manager.enable = true;
   home-manager = {
     backupFileExtension = "home.bak";
     extraSpecialArgs = { inherit inputs; };

hosts/thegeneralist-central/site.nix

@@ -0,0 +1,33 @@
+{ config, pkgs, ... }: let
+  domain = "thegeneralist01.com";
+in {
+  environment.systemPackages = [ pkgs.cloudflared ];
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts = {
+      "${domain}" = {
+        root = "/var/www/${domain}";
+        locations."/".tryFiles = "$uri $uri/ $uri/index.html";
+      };
+    };
+  };
+
+  age.secrets.cftcert.file = ./cert.pem.age;
+  age.secrets.cftcredentials.file = ./credentials.age;
+
+  services.cloudflared = {
+    enable = true;
+    certificateFile = config.age.secrets.cftcert.path;
+    tunnels."site" = {
+      ingress = {
+        "thegeneralist01.com" = "http://localhost:80";
+        "www.thegeneralist01.com" = "http://localhost:80";
+      };
+      default = "http_status:404";
+      credentialsFile = config.age.secrets.cftcredentials.path;
+      certificateFile = config.age.secrets.cftcert.path;
+    };
+  };
+}

modules/common/home-manager.nix

@@ -3,4 +3,8 @@
     useGlobalPkgs   = true;
     useUserPackages = true;
   };
+
+  home-manager.sharedModules = [{
+    programs.home-manager.enable = true;
+  }];
 }

secrets.nix

@@ -4,5 +4,8 @@ in {
   "hosts/thegeneralist/hostkey.age".publicKeys = [ thegeneralist ];
   "hosts/thegeneralist-central/hostkey.age".publicKeys = [ thegeneralist ];
 
+  "hosts/thegeneralist-central/cert.pem.age".publicKeys = [ thegeneralist ];
+  "hosts/thegeneralist-central/credentials.age".publicKeys = [ thegeneralist ];
+
   "modules/linux/tailscale-marshall.age".publicKeys = [ thegeneralist ];
 }