new website

hosts/fili/services/websites/homepage.nix

@@ -1,4 +1,10 @@
-{ flakes, pkgs, ... }:
+{
+  flakes,
+  pkgs,
+  config,
+  secrets,
+  ...
+}:
 let
   cache = pkg: ''
     location ~* \.(png|jpg|jpeg|gif|svg|ico|woff|woff2|ttf)$ {
@@ -32,15 +38,52 @@ let
       locations."/".return = return;
     }
     // ssl;
+
+  package = flakes.homepage.packages.${pkgs.system};
 in
 {
-  services.nginx = {
-    virtualHosts = {
-      "donsz.nl" = site regular;
-      "jdonszelmann.nl" = site regular;
-      "blog.donsz.nl" = redirect "301 https://donsz.nl/blog";
-      "gay.donsz.nl" = site gay;
-      "jana.is.fckn.gay" = site gay;
+  sops.secrets.homepage = {
+    sopsFile = "${secrets}/homepage.env";
+  };
+
+  systemd.services.homepage = {
+    description = "homepage";
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      DynamicUser = "yes";
+      ExecStart = "${pkgs.bash}/bin/bash ${package.website}/bin/run";
+      Restart = "on-failure";
+      RestartSec = "5s";
+      EnvironmentFile = config.sops.secrets.homepage.path;
+      WorkingDirectory = "${package.website}";
+      StateDirectory = "homepage";
+    };
+
+    environment = {
+      BETTER_AUTH_URL = "https://donsz.nl";
+      DATABASE_LOCATION = "/var/lib/homepage/db.sqlite";
+      HOST = "localhost";
+      PORT = "11020";
     };
   };
+
+  services.nginx.virtualHosts = {
+    "donsz.nl" = {
+      forceSSL = true;
+      enableACME = true;
+      extraConfig = ''
+        ${cache "${package.website}/homepage/client"}
+      '';
+      locations."/".proxyPass = "http://localhost:${toString 11020}";
+    };
+    "blog.donsz.nl" = redirect "301 https://donsz.nl/blog";
+  };
+  # services.nginx = {
+  # virtualHosts = {
+  #     "donsz.nl" = site regular;
+  #     "jdonszelmann.nl" = site regular;
+  #     "gay.donsz.nl" = site gay;
+  #     "jana.is.fckn.gay" = site gay;
+  # };
+  # };
 }