feat(hetzner): add my api and update website

servers/hetzner/modules/services/caddy.nix

@@ -249,13 +249,24 @@ in {
         '';
       };
 
+      "api.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          # Machine-facing license API for the Android app: no antiScrape
+          # bot-blocking (it would drop legitimate non-browser clients) and no
+          # admin_gate (endpoints are protected by the bearer token).
+          reverse_proxy 127.0.0.1:3004
+          encode zstd gzip
+        '';
+      };
+
       "releases.severijnse.eu" = {
         extraConfig = ''
           import security_headers
           root * /srv/releases
           file_server browse
           encode zstd gzip
-          
+
           handle /private* {
             import release_gate
           }

servers/hetzner/modules/services/virtualcam.nix

@@ -4,27 +4,28 @@
   unstablePkgs,
   ...
 }: let
-  rev = "6225e0fca02c02544341c92ecdc9634a9a15f45c";
-  src = pkgs.fetchgit {
-    url = "https://git.severijnse.eu/jory/virtualcam-website.git";
+  rev = "0e7135918c251ce6bcc2ead1d3f4cf0075ae2c55";
+  apiRev = "a73f4c4be840444072b0a7f5458438a34b470ea9";
+
+  # Private repositories are fetched over SSH (port 2222). nix-daemon runs as
+  # root and uses /root/.ssh (identity materialized by the git-ssh-key unit),
+  # so the source ends up in the store without any Nix-native credentials.
+  src = builtins.fetchGit {
+    url = "ssh://git@git.severijnse.eu:2222/jory/virtualcam-website.git";
     rev = rev;
-    sha256 = "17ihw2bhsp89nczljz6xzwlvxyzgsdn62ywmchp5blzd6jkxd3w0";
   };
 
-  # Patch the app to be fully dynamic and drop the Google-font download so the
-  # sandboxed Nix build needs neither a database nor network access.
-  srcPatched = pkgs.applyPatches {
-    name = "virtualcam-website-patched";
-    src = src;
-    patches = [./virtualcam-layout.patch ./virtualcam-build.patch];
+  apiSrc = builtins.fetchGit {
+    url = "ssh://git@git.severijnse.eu:2222/jory/virtualcam-api.git";
+    rev = apiRev;
   };
 
   # Build the Next.js app entirely in Nix (offline npm deps from the lockfile).
   app = unstablePkgs.buildNpmPackage {
     pname = "virtualcam-website";
     version = "0.1.0";
-    src = srcPatched;
-    npmDepsHash = "sha256-52ugs4ydwxGXLIhF/6P8uO400x3BRYk4NUt2Swob3cY=";
+    src = src;
+    npmDepsHash = "sha256-0g98Jh/RwoicjrfiSbfqNo331k3ab8hINjV6dHHN0y4=";
     nodejs = unstablePkgs.nodejs;
 
     buildPhase = ''
@@ -52,7 +53,61 @@
     CI = "true";
   };
 
+  # License validation / admin API (Go/Fiber), serving on host port 3004.
+  # go.mod demands go 1.26.5 but the pinned nixpkgs only has 1.26.4; the code
+  # uses nothing newer, so the directive is relaxed to match the toolchain.
+  api = unstablePkgs.buildGoModule {
+    pname = "virtualcam-api";
+    version = "0.1.0";
+    src = apiSrc;
+    vendorHash = "sha256-uvHClXHw9ycoIf6qBZmV2O3CSyIxCgnSPCSALM07qg8=";
+    go = unstablePkgs.go_1_26;
+    postPatch = ''
+      sed -i 's/^go 1\.26\.5$/go 1.26.4/' go.mod
+    '';
+  };
+
   dbUrl = "postgresql://virtualcam@localhost/virtualcam?host=/run/postgresql&schema=public";
+  # lib/pq parses the DSN differently from node-postgres: a hostname in the URL
+  # authority wins over a `host=` query param (so it would go over TCP and fail
+  # password auth), and lib/pq rejects unknown URL params like `schema`. Use a
+  # keyword DSN: unix-socket + peer auth + no SSL, matching the OS user.
+  apiDbUrl = "host=/run/postgresql user=virtualcam dbname=virtualcam sslmode=disable";
+
+  # Root-only runtime environment file holding the secrets both services need.
+  secretsFile = ../../secrets/secrets.yaml;
+  envFile = "/var/lib/virtualcam/environment";
+
+  # Materialize the license signing key and admin token from sops into a
+  # root-only file (0600). systemd reads environmentFiles before dropping
+  # privileges, so the service users never need to read it themselves.
+  writeSecrets = pkgs.writeShellScript "virtualcam-write-secrets" ''
+    set -euo pipefail
+    install -d -o virtualcam -g virtualcam -m 0750 /var/lib/virtualcam
+    : > "${envFile}"
+    chmod 0600 "${envFile}"
+    ${pkgs.sops}/bin/sops --decrypt --input-type yaml --output-type yaml ${secretsFile} |
+      ${pkgs.gnused}/bin/sed -nE \
+        's/^virtualcam_license_signing_key: (.*)/LICENSE_SIGNING_KEY=\1/p; s/^virtualcam_admin_token: (.*)/ADMIN_TOKEN=\1/p' \
+        >> "${envFile}"
+  '';
+
+  # Materialize the nix-daemon's SSH identity so private-repo fetches keep
+  # working after the one-off bootstrap copy in /root/.ssh.
+  writeGitSshKey = pkgs.writeShellScript "git-ssh-key" ''
+    set -euo pipefail
+    install -d -m 0700 /root/.ssh
+    ${pkgs.sops}/bin/sops --decrypt --extract '["git_ssh_key_b64"]' \
+      --input-type yaml --output-type yaml ${secretsFile} |
+      ${pkgs.coreutils}/bin/base64 -d > /root/.ssh/id_ed25519
+    chmod 0600 /root/.ssh/id_ed25519
+    cat > /root/.ssh/known_hosts <<'EOF'
+    git.severijnse.eu ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzIVo9Jdp8kwnWmTn26Fj68baJjwDphYw/0HTH5BzYY
+    [git.severijnse.eu]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDGcPKlvdxApYRCZuQxrljEdETrxAu0JsEJ+28zFaMfA3P69J9vEkqqAZZ0Uq3rtE8ZqPBxeDh7JYn2XChb+QVGjOHVWMCWqcdD43ws26eY91aHGYnO2kW+sKSxIh803tdifIp2q8VRnaHVXcLHLx2rmwmvqIfMLnEEShxAt4Q846DianBoA7S8heoBvMLi8AAO09sVEgMPWm8ULkoRq0poHslsKkdYKlWzecP85tPo/tlCEjQq5cC5+xidH9TS4ILxVIXGUfErZzbWZq5LtaRmqiU5U1+zzdb83oJvHFtTZ8wHwZX+VE4jZzKw7wdFPk+dJZp/3ZAVva6fLSjlpyyDFNWMcf2/18Gs6YioD1n2fr1dXruZiXNMnI19Dzyp+8yWIPbAeWyVx3BoCrcjIApEDMLMo7ut0l6RfNy80hYpY91VBrpsjSRLB4uCVDsqhTLPTrFUlu+9YY9lSHEUVLRylOLK54TbY089hbHOB/UdpyCiXpI0ds3ww1UmnDQSFjwNknc+wTXRvzEz+VsX2nAzfO+5NWq2jHNn4wH6GuAinAxSVg1A7Ub9VSmPelRiTzK6ZnplPm762MxcPFmo+y/5cszumUwypcyTS8MJIC57S/kabfsnjdt97K+9eT9X2LDZ2uIQgDS8qEgvbnvfXVmMoqakgBLYG7Embqc8BDzNsQ==
+    EOF
+    chmod 0600 /root/.ssh/known_hosts
+    test -f /root/.ssh/id_ed25519.pub || ${pkgs.openssh}/bin/ssh-keygen -y -f /root/.ssh/id_ed25519 > /root/.ssh/id_ed25519.pub
+  '';
 
   # The repo's seed uses tsx (a devDependency buildNpmPackage drops) plus the
   # "@/..." path alias. nixpkgs ships tsx, which honours tsconfig paths, so we
@@ -68,7 +123,7 @@
 
   # One shared PostgreSQL server (existing system postgres). Each service gets
   # its own database + role. virtualcam authenticates over the Unix socket via
-  # peer auth: the systemd service runs as OS user `virtualcam`, which matches
+  # peer auth: the systemd services run as OS user `virtualcam`, which matches
   # the database role `virtualcam`, so no password is stored anywhere.
   migrate = pkgs.writeShellScript "virtualcam-migrate" ''
     set -euo pipefail
@@ -83,7 +138,7 @@ in {
     users.virtualcam = {
       isSystemUser = true;
       group = "virtualcam";
-      description = "virtualcamera website service user";
+      description = "virtualcamera services user";
     };
     groups.virtualcam = {};
   };
@@ -100,6 +155,30 @@ in {
 
   systemd = {
     services = {
+      git-ssh-key = {
+        description = "Materialize nix-daemon git SSH key from sops";
+        wantedBy = ["multi-user.target"];
+        environment.SOPS_AGE_KEY_FILE = "/etc/age/keys.txt";
+        serviceConfig = {
+          Type = "oneshot";
+          Environment = ["HOME=/root"];
+          ExecStart = "${writeGitSshKey}";
+        };
+      };
+
+      virtualcam-secrets = {
+        description = "Materialize virtualcam secrets from sops";
+        wantedBy = ["multi-user.target"];
+        # The age key lives in /etc/age/keys.txt; the service must know where it
+        # is and needs a HOME for age to report its user config directory.
+        environment.SOPS_AGE_KEY_FILE = "/etc/age/keys.txt";
+        serviceConfig = {
+          Type = "oneshot";
+          Environment = ["HOME=/root"];
+          ExecStart = "${writeSecrets}";
+        };
+      };
+
       virtualcam-migrate = {
         description = "Virtualcam Prisma migrations";
         after = ["postgresql.service"];
@@ -135,14 +214,15 @@ in {
 
       virtualcam = {
         description = "Virtualcamera website (Next.js)";
-        after = ["postgresql.service" "virtualcam-migrate.service" "virtualcam-seed.service"];
-        requires = ["postgresql.service" "virtualcam-migrate.service" "virtualcam-seed.service"];
+        after = ["postgresql.service" "virtualcam-migrate.service" "virtualcam-seed.service" "virtualcam-secrets.service"];
+        requires = ["postgresql.service" "virtualcam-migrate.service" "virtualcam-seed.service" "virtualcam-secrets.service"];
         wantedBy = ["multi-user.target"];
         path = [unstablePkgs.nodejs];
         serviceConfig = {
           User = "virtualcam";
           Group = "virtualcam";
           WorkingDirectory = "${app}";
+          EnvironmentFile = [envFile];
           ExecStart = "${app}/node_modules/.bin/next start -p 3001 -H 127.0.0.1";
           Restart = "on-failure";
           RestartSec = 5;
@@ -163,9 +243,33 @@ in {
           ];
         };
       };
+
+      virtualcam-api = {
+        description = "Virtualcamera license API (Go/Fiber)";
+        after = ["postgresql.service" "virtualcam-migrate.service" "virtualcam-secrets.service"];
+        requires = ["postgresql.service" "virtualcam-migrate.service" "virtualcam-secrets.service"];
+        wantedBy = ["multi-user.target"];
+        serviceConfig = {
+          User = "virtualcam";
+          Group = "virtualcam";
+          WorkingDirectory = "${api}";
+          EnvironmentFile = [envFile];
+          ExecStart = "${api}/bin/virtualcam-api";
+          Restart = "on-failure";
+          RestartSec = 5;
+          StateDirectory = "virtualcam";
+          StateDirectoryMode = "0750";
+          Environment = [
+            "PORT=3004"
+            "DATABASE_URL=${apiDbUrl}"
+            "CORS_ORIGINS=https://virtualcam.severijnse.eu"
+            "HOME=/var/lib/virtualcam"
+          ];
+        };
+      };
     };
   };
 
-  # Serve behind Caddy on 127.0.0.1:3000 (virtualHost wired in caddy.nix).
+  # Served behind Caddy (virtualHosts wired in caddy.nix).
   networking.firewall.allowedTCPPorts = [];
 }