+ ]
+
+ the headers include everything from the s3cmd user (root because docker) to random AWS IDs.
+
+ this is where our bestie nginx comes in.
+
+ [em:(and yo just so its clear, we use nix a lot in the dollhive.)]
+ [codeblock::
+ services.nginx.virtualHosts."blood.pet" = {
+ locations."/" = {
+ recommendedProxySettings = true;
+ proxyPass = "http://127.0.0.1:9000/blood.pet/"; # trailing slash Required.
+ extraConfig = ''
+ # try to catch errors
+ proxy_intercept_errors on;
+
+ # minio why so fingerprintable....
+ proxy_hide_header x-amz-request-id;
+ proxy_hide_header x-amz-bucket-region;
+ proxy_hide_header x-amz-id-2;
+ proxy_hide_header x-amz-meta-s3cmd-attrs;
+ proxy_hide_header x-ratelimit-limit;
+ proxy_hide_header x-ratelimit-remaining;
+ proxy_hide_header x-minio-deployment-id;
+ proxy_hide_header strict-transport-security;
+ proxy_hide_header x-firefox-spdy;
+ proxy_hide_header x-xss-protection;
+ proxy_hide_header x-content-type-options;
+ proxy_hide_header vary;
+
+ # prevent minio fingerprinting back...
+ proxy_set_header user-agent "";
+
+ # and especially dont POST its server omg
+ proxy_method GET;
+
+ # fix example: https://blood.pet/ to request /blood.pet/index.html
+ # fix example: https://blood.pet/pronouns/ to request /blood.pet/pronouns/index.html
+ rewrite (.*)/$ $1/index.html;
+ '';
+ };
+ };
+ ]
+
+ so we can just kinda yeet all those out.
+
+ nginx now lives as our "CDN" layer. nice. its job is to do all the internal-to-external bridging to minio.
+
+ &a bird in the hand...
+
+ woodpecker is a different story; we want this in its own machine, separate and safe away from
+ the common dangers of the Proxmox cluster or even just the internet.
+
+ we use forgejo so we'll also cover configuration for that.
+
+ [codeblock::
+ # just so its there when we SSH
+ environment.systemPackages = [
+ pkgs.woodpecker-cli
+ ];
+
+ services.woodpecker-server = {
+ enable = true;
+ environment = {
+ WOODPECKER_HOST = "https://";
+ WOODPECKER_SERVER_ADDR = ":9001";
+ WOODPECKER_GRPC_PORT = ":9000";
+ WOODPECKER_OPEN = "true";
+ WOODPECKER_FORGEJO = "true";
+ WOODPECKER_FORGEJO_URL = "https://";
+ WOODPECKER_ADMIN = "noe";
+ };
+ environmentFile = /secrets/yay;
+ # get these from /user/settings/applications
+ # WOODPECKER_FORGEJO_CLIENT=awawawawa
+ # WOODPECKER_FORGEJO_SECRET=dolldolldoll
+ };
+
+ services.woodpecker-agents.agents."podman" = {
+ enable = true;
+ environment = {
+ WOODPECKER_SERVER = "localhost:9000";
+ WOODPECKER_BACKEND = "docker";
+ WOODPECKER_MAX_WORKFLOWS = "4";
+ DOCKER_HOST = "unix:///run/podman/podman.sock";
+ WOODPECKER_HEALTHCHECK = "false";
+ WOODPECKER_GRPC_SECURE = "false";
+ };
+ extraGroups = [ "podman" ];
+ environmentFile = [ /secrets/yay ];
+ # get this from /admin/agents
+ # WOODPECKER_AGENT_SECRET=dolldolldollawawawawawa
+ };
+
+ virtualisation.podman = {
+ enable = true;
+ defaultNetwork.settings = {
+ dns_enabled = true;
+ };
+ autoPrune = {
+ enable = true;
+ dates = "daily";
+ };
+ };
+ ]
+
+ and just like that, we have our woodpecker thing going. awawa!!!
+
+ &the final piece, automation
+
+ we made it!!!
+
+ go make an access key in minio, and save those as secrets in woodpecker!
+ we named it like [code:static_sites_client] but anything's cool.
+
+ so our last step is to make a step file, [code:.woodpecker/build-deploy.yaml]
+
+ [codeblock::
+ when:
+ - event: push
+ branch: main
+
+ steps:
+ - name: build & deploy
+ image: nixos/nix
+ commands:
+ - echo 'experimental-features = flakes nix-command' >> /etc/nix/nix.conf
+ - nix build -L .
+ - |
+ nix-shell -p s3cmd --command 's3cmd \
+ --host=static-sites:9000 \
+ --host-bucket=static-sites:9000 \
+ --no-ssl \
+ sync result/* s3://blood.pet'
+ environment:
+ AWS_ACCESS_KEY_ID:
+ from_secret: static_sites_client
+ AWS_SECRET_ACCESS_KEY:
+ from_secret: static_sites_secret
+ ]
+
+ what's going on here?
+ = we tell nix it should know what a "flake" is
+ = we build it (with -L for live logs)
+ = we use s3cmd to upload it
+ - we set `--host` and `--host-bucket` to the same thing, this isn't S3
+ - disable SSL because haha doll
+
+ &ad extremum
+
+ so our server architecture now looks like
+
+ [invoke(mermaid)(-x 2 -y 2 -p 0)::
+ flowchart TD
+ https://blood.pet -->|static-sites| nginx
+ nginx -->|http| minio
+ git commit --> woodpecker
+ woodpecker -->|s3cmd| minio
+ ]
+
+ also you're looking at this site, all deployed with the above :>
+
+ &links
+ - blood.pet on git: [link(https://git.sapphic.engineer/noe/blood.pet/):noe/blood.pet]
+ - static-sites config: [link(https://git.sapphic.engineer/noe/nixos/src/branch/main/nixos/hosts/static-sites):noe/nixos:/nixos/hosts/static-sites]
+ - woodpecker config: [link(https://git.sapphic.engineer/noe/nixos/src/branch/main/nixos/hosts/woodpecker/default.nix):noe/nixos:/nixos/hosts/woodpecker/default.nix]
\ No newline at end of file
diff --git a/log/index.doll b/log/index.doll
new file mode 100644
index 0000000..3cb1890
--- /dev/null
+++ b/log/index.doll
@@ -0,0 +1,6 @@
+---
+title: ls log
+description: 41666 logs
+---
+
+[invoke(logroll)]
\ No newline at end of file
diff --git a/plugins/logroll.sh b/plugins/logroll.sh
new file mode 100755
index 0000000..eff63e2
--- /dev/null
+++ b/plugins/logroll.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+cd log
+
+echo "
"
+
+for file in "$(ls -1 ???-*.doll)"; do
+ echo "
"
\ No newline at end of file
diff --git a/plugins/mermaid.sh b/plugins/mermaid.sh
new file mode 100755
index 0000000..5914f76
--- /dev/null
+++ b/plugins/mermaid.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+echo "