feat: include hectic-landing to hectic

flake.lock

@@ -323,6 +323,26 @@
         "type": "github"
       }
     },
+    "hectic-landing": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-fixed"
+        ]
+      },
+      "locked": {
+        "lastModified": 1777564161,
+        "narHash": "sha256-2ZyXQDOTtcB6B7pSJnSrmGyUcC/JUrfBl6RbvnKwzcE=",
+        "ref": "refs/heads/main",
+        "rev": "88bae39c4c60fdffa1b20f533146b41bfbe8e1c5",
+        "revCount": 8,
+        "type": "git",
+        "url": "ssh://git@github.com/liquizz/hectic-landing.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@github.com/liquizz/hectic-landing.git"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -938,6 +958,7 @@
       "inputs": {
         "deploy-rs": "deploy-rs",
         "disko": "disko",
+        "hectic-landing": "hectic-landing",
         "home-manager": "home-manager",
         "hyprland": "hyprland",
         "impermanence": "impermanence",

flake.nix

@@ -52,6 +52,12 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
+    hectic-landing = {
+      # NOTE(yukkop): private repo - SSH access required.
+      # Only evaluated when nixosConfigurations."hectic-lab|x86_64-linux" is built.
+      url = "git+ssh://git@github.com/liquizz/hectic-landing.git";
+      inputs.nixpkgs.follows = "nixpkgs-fixed";
+    };
   };
 
   outputs = {

nixos/system/hectic-lab/hectic-lab.nix

@@ -27,10 +27,24 @@ in {
     self.nixosModules."shadowsocks-rust" # NOTE(nrv): impl
     self.nixosModules."shadowsocks"      # NOTE(nrv): usage/instance
 
+    inputs.hectic-landing.nixosModules.hectic-landing
+
     (import ./containers.nix          { inherit flake self inputs; })
     (import (./. + "/sentinèlla.nix") { inherit flake self inputs domain sslOpts; })
   ];
 
+  services.hectic-landing = {
+    enable  = true;
+    package = inputs.hectic-landing.packages.${pkgs.system}.hectic-landing;
+    domain  = domain;
+    port    = 3000;
+    host    = "127.0.0.1";
+  };
+
+  # NOTE(yukkop): both nixos-mailserver and hectic-landing module set
+  # security.acme.defaults.email. Force the mailserver-aligned address.
+  security.acme.defaults.email = lib.mkForce "security@${domain}";
+
   hectic = {
     archetype.dev.enable = true;
     hardware.hetzner-cloud = {
@@ -169,24 +183,8 @@ in {
 
   services.nginx = {
     enable = true;
-    virtualHosts.${domain} = sslOpts // {
-      forceSSL = true;
-      locations."/" = {
-        extraConfig = ''
-          root ${"${flake}/nixos/system/hectic-lab/static"};
-          try_files $uri $uri/ /index.html;
-        '';
-      };
-    };
-    virtualHosts."umbriel.${domain}" = sslOpts // {
-      forceSSL = true;
-      locations."/" = {
-        extraConfig = ''
-          root ${"${flake}/nixos/system/hectic-lab/static"};
-          try_files $uri $uri/ /index.html;
-        '';
-      };
-    };
+    # NOTE(yukkop): virtualHosts.${domain} is owned by the hectic-landing module
+    # (ACME-managed). See services.hectic-landing above.
     virtualHosts."store.${domain}" = sslOpts // {
       forceSSL = true;
       root = "/var/www/store";