Deploy soju

common/fragments/kanidm.nix

@@ -4,7 +4,7 @@ let
 in
 {
   services.kanidm = {
-    package = pkgs.kanidm_1_10;
+    package = pkgs.kanidm_1_11;
     server = {
       enable = true;
       settings = {

common/fragments/soju.nix

@@ -0,0 +1,40 @@
+{ config, ... }:
+let
+  domain = "irc.technogothic.net";
+  ircs_port = 6697;
+  irc_port = 6667;
+in
+{
+  services.soju = {
+    enable = true;
+    hostName = domain;
+
+    listen = [ "irc://localhost:${toString irc_port}" ];
+  };
+
+  networking.firewall.allowedTCPPorts = [ ircs_port ];
+
+  services.nginx = {
+    virtualHosts."${domain}" = {
+      useACMEHost = "technogothic.net";
+      forceSSL = true;
+    };
+
+    streamConfig =
+      let
+        cert_root = config.security.acme.certs."technogothic.net".directory;
+      in
+      ''
+        server {
+          listen ${toString ircs_port} ssl;
+          listen [::]:${toString ircs_port} ssl;
+          proxy_pass localhost:${toString irc_port};
+          proxy_protocol on;
+
+          ssl_certificate ${cert_root}/fullchain.pem;
+          ssl_certificate_key ${cert_root}/key.pem;
+          ssl_trusted_certificate ${cert_root}/chain.pem;
+        }
+      '';
+  };
+}

hosts/synchronicity/configuration.nix

@@ -17,6 +17,7 @@
     ../../common/fragments/hedgedoc.nix
     ../../common/fragments/kanidm.nix
     ../../common/fragments/prometheus.nix
+    ../../common/fragments/soju.nix
     ../../common/fragments/sops.nix
     ../../common/fragments/storage.nix
     ../../common/fragments/vsftpd.nix