From 70c44f1fa7b258c2beaab5696523aca1cf2887b5 Mon Sep 17 00:00:00 2001
From: yukkop <hectic.yukkop@gmail.com>
Date: Thu, 30 Apr 2026 19:33:21 +0000
Subject: [PATCH] feat: include hectic-landing to hectic

---
 flake.lock                             | 21 ++++++++++++++++
 flake.nix                              |  6 +++++
 nixos/system/hectic-lab/hectic-lab.nix | 34 ++++++++++++--------------
 3 files changed, 43 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 72fda8e..e005e44 100644
--- a/flake.lock
+++ b/flake.lock
@@ -323,6 +323,26 @@
         "type": "github"
       }
     },
+    "hectic-landing": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-fixed"
+        ]
+      },
+      "locked": {
+        "lastModified": 1777564161,
+        "narHash": "sha256-2ZyXQDOTtcB6B7pSJnSrmGyUcC/JUrfBl6RbvnKwzcE=",
+        "ref": "refs/heads/main",
+        "rev": "88bae39c4c60fdffa1b20f533146b41bfbe8e1c5",
+        "revCount": 8,
+        "type": "git",
+        "url": "ssh://git@github.com/liquizz/hectic-landing.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@github.com/liquizz/hectic-landing.git"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -938,6 +958,7 @@
       "inputs": {
         "deploy-rs": "deploy-rs",
         "disko": "disko",
+        "hectic-landing": "hectic-landing",
         "home-manager": "home-manager",
         "hyprland": "hyprland",
         "impermanence": "impermanence",
diff --git a/flake.nix b/flake.nix
index b8a92fb..25fb619 100644
--- a/flake.nix
+++ b/flake.nix
@@ -52,6 +52,12 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
+    hectic-landing = {
+      # NOTE(yukkop): private repo - SSH access required.
+      # Only evaluated when nixosConfigurations."hectic-lab|x86_64-linux" is built.
+      url = "git+ssh://git@github.com/liquizz/hectic-landing.git";
+      inputs.nixpkgs.follows = "nixpkgs-fixed";
+    };
   };
 
   outputs = {
diff --git a/nixos/system/hectic-lab/hectic-lab.nix b/nixos/system/hectic-lab/hectic-lab.nix
index e94e0b5..51b7371 100644
--- a/nixos/system/hectic-lab/hectic-lab.nix
+++ b/nixos/system/hectic-lab/hectic-lab.nix
@@ -27,10 +27,24 @@ in {
     self.nixosModules."shadowsocks-rust" # NOTE(nrv): impl
     self.nixosModules."shadowsocks"      # NOTE(nrv): usage/instance
 
+    inputs.hectic-landing.nixosModules.hectic-landing
+
     (import ./containers.nix          { inherit flake self inputs; })
     (import (./. + "/sentinèlla.nix") { inherit flake self inputs domain sslOpts; })
   ];
 
+  services.hectic-landing = {
+    enable  = true;
+    package = inputs.hectic-landing.packages.${pkgs.system}.hectic-landing;
+    domain  = domain;
+    port    = 3000;
+    host    = "127.0.0.1";
+  };
+
+  # NOTE(yukkop): both nixos-mailserver and hectic-landing module set
+  # security.acme.defaults.email. Force the mailserver-aligned address.
+  security.acme.defaults.email = lib.mkForce "security@${domain}";
+
   hectic = {
     archetype.dev.enable = true;
     hardware.hetzner-cloud = {
@@ -169,24 +183,8 @@ in {
 
   services.nginx = {
     enable = true;
-    virtualHosts.${domain} = sslOpts // {
-      forceSSL = true;
-      locations."/" = {
-        extraConfig = ''
-          root ${"${flake}/nixos/system/hectic-lab/static"};
-          try_files $uri $uri/ /index.html;
-        '';
-      };
-    };
-    virtualHosts."umbriel.${domain}" = sslOpts // {
-      forceSSL = true;
-      locations."/" = {
-        extraConfig = ''
-          root ${"${flake}/nixos/system/hectic-lab/static"};
-          try_files $uri $uri/ /index.html;
-        '';
-      };
-    };
+    # NOTE(yukkop): virtualHosts.${domain} is owned by the hectic-landing module
+    # (ACME-managed). See services.hectic-landing above.
     virtualHosts."store.${domain}" = sslOpts // {
       forceSSL = true;
       root = "/var/www/store";