4 files changed, 53 insertions, 88 deletions
diff --git a/nix/configuration.nix b/nix/configuration.nix
deleted file mode 100644
index 96c5e48..0000000
--- a/nix/configuration.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{config, ...}: {
-  imports = [
-    ./hardware-configuration.nix
-    ./minecraft.nix
-    ./options.nix
-    ./git.nix
-    ./ssh.nix
-    ./web.nix
-  ];
-  
-  boot.loader = {
-    systemd-boot = {
-      enable = true;
-      graceful = true; # TODO: drop after v261+
-    };
-    efi.canTouchEfiVariables = true;
-  };
-
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-
-  networking.hostName = "chariot";
-  networking.networkmanager.enable = true;
-
-  users.users.kassouni = {
-    extraGroups = [ "wheel" ];
-    isNormalUser = true;
-    openssh.authorizedKeys.keys = config.my.adminKeys;
-  };
-
-  system.stateVersion = "26.05";
-}
diff --git a/nix/git.nix b/nix/git.nix
deleted file mode 100644
index 4b3b493..0000000
--- a/nix/git.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{config, pkgs, ...}: let
-  domain = "git.kassouni.net";
-  repoRoot = "/srv/git";
-in {
-  users.users.git = {
-    isSystemUser = true;
-    group = "git";
-    home = repoRoot;
-    createHome = true;
-    homeMode = "750"; 
-    shell = "${pkgs.git}/bin/git-shell";
-    openssh.authorizedKeys.keys = config.my.gitKeys;
-  };
-  users.groups.git = { };
-
-  environment.systemPackages = [ pkgs.git ];
-
-  services.openssh.extraConfig = ''
-    Match user git
-      AllowTcpForwarding no
-      AllowAgentForwarding no
-      PermitTTY no
-  '';
-
-  services.cgit.${domain} = {
-    enable = true;
-    scanPath = repoRoot;
-    group = "git"; # so cgit can traverse a non-world-readable repoRoot
-    gitHttpBackend.checkExportOkFiles = true;
-    settings = {
-      strict-export = "git-daemon-export-ok";
-      remove-suffix = true;
-      readme = [ ":README.md" ":README" ":readme.md" ];
-      clone-url = "git@${domain}:$CGIT_REPO_URL https://${domain}/$CGIT_REPO_URL";
-      source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
-      about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
-    };
-  };
-
-  services.nginx.virtualHosts.${domain} = {
-    forceSSL = true;
-    enableACME = true;
-  };
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "alex@kassouni.net";
-  };
-
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-}
diff --git a/nix/site.nix b/nix/site.nix
new file mode 100644
index 0000000..45209ff
--- /dev/null
+++ b/nix/site.nix
@@ -0,0 +1,23 @@
+{ pkgs }:
+
+pkgs.stdenvNoCC.mkDerivation {
+  pname = "kassouni-net";
+  version = "0.1.0";
+
+  # style/ sits outside the zola project because cgit shares its partials
+  src = pkgs.lib.fileset.toSource {
+    root = ../.;
+    fileset = pkgs.lib.fileset.unions [ ../site ../style ];
+  };
+
+  nativeBuildInputs = [ pkgs.zola ];
+
+  buildPhase = "zola --root site build";
+  installPhase = "cp -r site/public $out";
+
+  meta = {
+    description = "The personal website of Alex Kassouni";
+    license = pkgs.lib.licenses.mit;
+    platforms = pkgs.lib.platforms.all;
+  };
+}
diff --git a/nix/web.nix b/nix/web.nix
index b34f8d8..0013d4f 100644
--- a/nix/web.nix
+++ b/nix/web.nix
@@ -1,8 +1,32 @@
-{...}: {
-  # dont serve git.kassouni.net traffic to other subdomains
-  services.nginx.virtualHosts."_" = {
-    default = true;
-    rejectSSL = true;
-    locations."/".return = 444;
+{inputs, pkgs, ...}: let
+  domain = "kassouni.net";
+in {
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedTlsSettings = true;
+
+    virtualHosts = {
+      # dont serve kassouni.net traffic to other subdomains
+      "_" = {
+        default = true;
+        rejectSSL = true;
+        locations."/".return = 444;
+      };
+
+      ${domain} = {
+        forceSSL = true;
+        enableACME = true;
+        root = inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.website;
+      };
+    };
   };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "alex@${domain}";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 }