From 65547b241d7b86cd0b309045d10cfec3483e3df5 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Thu, 20 Aug 2026 22:20:13 +0200
Subject: more tower migration stuff, prepare for cgit-public migration

---
 hosts/sagittarius/web/default.nix |  1 -
 hosts/sagittarius/web/git.nix     | 59 ---------------------------------------
 hosts/tower/default.nix           |  4 ++-
 hosts/tower/network.nix           | 12 +++++++-
 hosts/tower/web/default.nix       | 12 ++++----
 hosts/tower/web/git.nix           | 47 +++++++++++++++----------------
 6 files changed, 42 insertions(+), 93 deletions(-)
 delete mode 100644 hosts/sagittarius/web/git.nix

(limited to 'hosts')

diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
index 1cfc7aa..bd45483 100644
--- a/hosts/sagittarius/web/default.nix
+++ b/hosts/sagittarius/web/default.nix
@@ -3,7 +3,6 @@
   imports = [
     # ./blog.nix
     # ./mediadb.nix
-    ./git.nix
     # ./static.nix
     # ./navidrome.nix
     ./vaultwarden.nix
diff --git a/hosts/sagittarius/web/git.nix b/hosts/sagittarius/web/git.nix
deleted file mode 100644
index 8e7b772..0000000
--- a/hosts/sagittarius/web/git.nix
+++ /dev/null
@@ -1,59 +0,0 @@
-{ config, ... }:
-let
-  # secrets = config.sops.secrets;
-  domainInternal = "git.sorre.internal";
-  domainPublic = "git.sorre.xyz";
-
-  commonSettings = {
-    readme = "main:README.md";
-  };
-in
-{
-  imports = [ ./acme.nix ];
-
-  services.nginx = {
-    enable = true;
-    # virtualHosts."${domainInternal}" = {
-    #   forceSSL = true;
-    #   sslCertificateKey = secrets."wg-ca-key".path;
-    #   sslCertificate = secrets."wg-ca-crt".path;
-    #   listen = [
-    #     {
-    #       addr = "100.64.0.3";
-    #       port = 443;
-    #       ssl = true;
-    #     }
-    #   ];
-    # };
-
-    virtualHosts."${domainPublic}" = {
-      enableACME = true;
-      forceSSL = true;
-    };
-  };
-
-  # services.cgit.internal = {
-  #   enable = false;
-  #   user = "cgit-internal";
-  #   group = "cgit";
-  #   nginx.virtualHost = domainInternal;
-  #   gitHttpBackend.checkExportOkFiles = false;
-  #   scanPath = "/var/lib/git/repos/isabella";
-  #   settings = commonSettings;
-  # };
-
-  services.cgit.public = {
-    enable = true;
-    user = "cgit-public";
-    group = "cgit";
-    nginx.virtualHost = domainPublic;
-    gitHttpBackend.checkExportOkFiles = false;
-    repos = {
-      futils.path = "/var/lib/git/repos/isabella/futils";
-      sorre-website.path = "/var/lib/git/repos/isabella/sorre-website";
-      xpkgs.path = "/var/lib/git/repos/isabella/xpkgs";
-      nixos-config.path = "/var/lib/git/repos/isabella/nixos-config";
-    };
-    settings = commonSettings;
-  };
-}
diff --git a/hosts/tower/default.nix b/hosts/tower/default.nix
index 9b8f652..ce72046 100644
--- a/hosts/tower/default.nix
+++ b/hosts/tower/default.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ pkgs, ... }:
 {
   imports = [
     # Include the results of the hardware scan.
@@ -47,6 +47,8 @@
     };
   };
 
+  environment.systemPackages = [ pkgs.git pkgs.helix ];
+
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave
diff --git a/hosts/tower/network.nix b/hosts/tower/network.nix
index fc0fdc5..09a97a3 100644
--- a/hosts/tower/network.nix
+++ b/hosts/tower/network.nix
@@ -1,7 +1,17 @@
-{ ... }:
+{ config, ... }:
 {
   networking = {
     hostName = "tower";
     networkmanager.enable = true;
+    firewall = {
+      checkReversePath = "loose";
+      trustedInterfaces = [ "tailscale0" ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
+    };
+  };
+
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
   };
 }
diff --git a/hosts/tower/web/default.nix b/hosts/tower/web/default.nix
index 2424eaf..76429b7 100644
--- a/hosts/tower/web/default.nix
+++ b/hosts/tower/web/default.nix
@@ -1,11 +1,11 @@
 { ... }:
 {
   imports = [
-    ./blog.nix
-    ./mediadb.nix
-    ./git.nix
-    ./static.nix
-    ./navidrome.nix
-    ./vaultwarden.nix
+    # ./blog.nix
+    # ./mediadb.nix
+    # ./git.nix
+    # ./static.nix
+    # ./navidrome.nix
+    # ./vaultwarden.nix
   ];
 }
diff --git a/hosts/tower/web/git.nix b/hosts/tower/web/git.nix
index 4dcae8e..e94b1d3 100644
--- a/hosts/tower/web/git.nix
+++ b/hosts/tower/web/git.nix
@@ -11,34 +11,31 @@ in
 {
   services.nginx = {
     enable = true;
-    virtualHosts."${domainInternal}" = {
-      # forceSSL = true;
-      # sslCertificateKey = secrets."wg-ca-key".path;
-      # sslCertificate = secrets."wg-ca-crt".path;
-      listen = [
-        {
-          addr = "100.64.0.3";
-          port = 443;
-          # ssl = true;
-        }
-      ];
-    };
+    # virtualHosts."${domainInternal}" = {
+    #   forceSSL = true;
+    #   # sslCertificateKey = secrets."wg-ca-key".path;
+    #   # sslCertificate = secrets."wg-ca-crt".path;
+    #   listen = [
+    #     {
+    #       addr = "100.64.0.3";
+    #       port = 443;
+    #       # ssl = true;
+    #     }
+    #   ];
+    # };
 
-    virtualHosts."${domainPublic}" = {
-      # enableACME = true;
-      # forceSSL = true;
-    };
+    # virtualHosts."${domainPublic}" = { };
   };
 
-  services.cgit.internal = {
-    enable = true;
-    user = "cgit-internal";
-    group = "cgit";
-    nginx.virtualHost = domainInternal;
-    gitHttpBackend.checkExportOkFiles = false;
-    scanPath = "/var/lib/git/repos/isabella";
-    settings = commonSettings;
-  };
+  # services.cgit.internal = {
+  #   enable = true;
+  #   user = "cgit-internal";
+  #   group = "cgit";
+  #   nginx.virtualHost = domainInternal;
+  #   gitHttpBackend.checkExportOkFiles = false;
+  #   scanPath = "/var/lib/git/repos/isabella";
+  #   settings = commonSettings;
+  # };
 
   services.cgit.public = {
     enable = true;
-- 
cgit v1.3.1