feat: skynet user stuff is now segregated to a server that is untrusted

applications/skynet_users.nix

@@ -0,0 +1,72 @@
+{ config, pkgs, lib, inputs, ... }:
+  with lib;
+  let
+    cfg = config.services.skynet_users;
+  in {
+
+  imports = [
+    ./acme.nix
+    ./dns.nix
+    ./nginx.nix
+  ];
+
+  options.services.skynet_users = {
+    host = {
+      ip = mkOption {
+        type = types.str;
+      };
+      name = mkOption {
+        type = types.str;
+      };
+    };
+  };
+
+  config = {
+    # ssh access
+
+    # allow more than admins access
+    services.skynet_ldap_client = {
+      groups = [
+        "skynet-admins-linux"
+        "skynet-users-linux"
+      ];
+    };
+
+
+    # Website config
+    skynet_acme.domains = [
+        "users.skynet.ie"
+      "*.users.skynet.ie"
+    ];
+
+    skynet_dns.records = [
+      {record  ="users"; r_type="CNAME"; value=cfg.host.name;}
+      {record="*.users"; r_type="CNAME"; value=cfg.host.name;}
+    ];
+
+    networking.firewall.allowedTCPPorts = [80 443];
+
+    # normally services cannot read home dirs
+    systemd.services.nginx.serviceConfig.ProtectHome="read-only";
+
+    services.nginx.virtualHosts = {
+      # main site
+      "*.users.skynet.ie" = {
+        forceSSL = true;
+        useACMEHost = "skynet";
+        serverName = "~^(?<user>.+)\.users\.skynet\.ie";
+
+        # username.users.skynet.ie/
+        # user goes:
+        #   chmod 711 ~
+        #   chmod -R 755 ~/public_html
+
+        locations."/" = {
+          alias = "/home/$user/public_html/";
+          index = "index.html";
+          extraConfig = "autoindex on;";
+        };
+      };
+    };
+  };
+}