From 950c71e78d708e177260c3f3ba7d06ce36ba0ecb Mon Sep 17 00:00:00 2001
From: Fiscal Velvet Poet <fiscalvelvetpoet@jfdic.org>
Date: Thu, 18 Nov 2021 10:16:34 +1000
Subject: [PATCH] hakyll-skeleton: initial deployment

---
 hosts/toscano.nix            | 16 +++++++-------
 nix/sources.json             |  6 ++++++
 profiles/hakyll-skeleton.nix | 42 ++++++++++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+), 8 deletions(-)
 create mode 100644 profiles/hakyll-skeleton.nix

diff --git a/hosts/toscano.nix b/hosts/toscano.nix
index 5d68e0d..049686e 100644
--- a/hosts/toscano.nix
+++ b/hosts/toscano.nix
@@ -6,17 +6,17 @@
 
 {
 
-  imports =
-    [
-      ../networks/linode.nix
-      ../profiles/gitea.nix
-      ../profiles/jfdic-web.nix
-      ../secrets/gitea.nix
-    ];
+  imports = [
+    ../networks/linode.nix
+    ../profiles/gitea.nix
+    ../profiles/hakyll-skeleton.nix
+    ../profiles/jfdic-web.nix
+    ../secrets/gitea.nix
+  ];
 
   deployment.targetHost = "45.79.236.198";
 
   networking.hostName = "toscano";
 
-  system.stateVersion = "21.05";   # The version of NixOS originally installed
+  system.stateVersion = "21.05"; # The version of NixOS originally installed
 }
diff --git a/nix/sources.json b/nix/sources.json
index fad915b..d85e886 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -1,4 +1,10 @@
 {
+    "hakyll-skeleton": {
+        "sha256": "1j8cv3fn6mhkqwqz9rg8cg5lf76z381rx5s4gb7rjyly53jbjbjv",
+        "type": "tarball",
+        "url": "https://source.jfdic.org/jfdic/hakyll-skeleton/archive/edd1e1bd083f3ad59572b35fd783865ec91e92f4.tar.gz",
+        "url_template": "https://source.jfdic.org/jfdic/hakyll-skeleton/archive/edd1e1bd083f3ad59572b35fd783865ec91e92f4.tar.gz"
+    },
     "jfdic-web": {
         "sha256": "0qq4ww89isivyllqs15cg21f4g9fhy3zpiywxash2hk5dg6klx50",
         "type": "tarball",
diff --git a/profiles/hakyll-skeleton.nix b/profiles/hakyll-skeleton.nix
new file mode 100644
index 0000000..8a9ec7a
--- /dev/null
+++ b/profiles/hakyll-skeleton.nix
@@ -0,0 +1,42 @@
+# NixOps configuration for deploying the JFDIC website
+
+{ config, pkgs, ... }:
+
+let
+  sources = import ../nix/sources.nix;
+  hakyll-skeleton = import sources.hakyll-skeleton { };
+  webdomain = "skeleton.jfdic.org";
+
+in {
+
+  environment.sessionVariables = {
+    LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
+  };
+
+  services.nginx = {
+    enable = true; # Enable Nginx
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts = {
+      "${webdomain}" = { # website hostname
+        enableACME = true; # Use ACME certs
+        forceSSL = true; # Force SSL
+        root = "${hakyll-skeleton}"; # Wesbite root
+      };
+      "www.${webdomain}" = { # Respect our elders :-)
+        locations."/".extraConfig =
+          "return 301 $scheme://${webdomain}$request_uri;";
+      };
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    certs = { "${webdomain}" = { email = "admin@${webdomain}"; }; };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+}