From 7fd1736f1dd8a959369797775ba4dc1d66c2284c Mon Sep 17 00:00:00 2001
From: oqyude <oqyude@gmail.com>
Date: Wed, 7 Oct 2026 17:12:07 +0300
Subject: [PATCH] vtimeline arch

---
 modules/server/coredns.nix                    |  1 +
 modules/server/nginx.nix                      | 30 +++++++++++++++++++
 .../server/secrets/vtimeline-htpasswd.yaml    | 25 ++++++++++++++++
 3 files changed, 56 insertions(+)
 create mode 100644 modules/server/secrets/vtimeline-htpasswd.yaml

diff --git a/modules/server/coredns.nix b/modules/server/coredns.nix
index da0a0a0..a6b6646 100644
--- a/modules/server/coredns.nix
+++ b/modules/server/coredns.nix
@@ -26,6 +26,7 @@
               192.168.1.20 syncthing.zeroq.su
               192.168.1.20 talk.zeroq.su
               192.168.1.20 turn.zeroq.su
+              192.168.1.20 vtimeline.zeroq.su
               fallthrough
           }
           cache 300
diff --git a/modules/server/nginx.nix b/modules/server/nginx.nix
index 6b8268d..6502929 100644
--- a/modules/server/nginx.nix
+++ b/modules/server/nginx.nix
@@ -123,6 +123,21 @@ in
         forceSSL = true;
         enableACME = true;
       };
+      # vtimeline.zeroq.su — stub behind HTTP basic auth.
+      # Credentials are pulled from sops (format = yaml, key = "passwords"),
+      # file content is htpasswd-format (one "user:hash" per line).
+      # Empty file = 401 for everyone until somebody populates the secret:
+      #   sops modules/server/secrets/vtimeline-htpasswd.yaml
+      #   htpasswd -nbB <login> <password> | sed 's/:$//'
+      "vtimeline.zeroq.su" = {
+        forceSSL = true;
+        enableACME = true;
+        root = pkgs.writeTextDir "index.html" "<!doctype html><html><body>Nothing here yet.</body></html>";
+        extraConfig = ''
+          auth_basic "vtimeline";
+          auth_basic_user_file ${config.sops.secrets.vtimeline-htpasswd.path};
+        '';
+      };
       "pdf.private" = {
         forceSSL = false;
         enableACME = false;
@@ -251,4 +266,19 @@ in
     80
     443
   ];
+
+  # htpasswd file for vtimeline.zeroq.su basic auth.
+  # Source layout (per modules/server/secrets/vtimeline-htpasswd.yaml):
+  #   passwords: |
+  #     <user>:<bcrypt-or-apr1-hash>
+  # sops-nix extracts the `passwords` key as the only decrypted content.
+  # The resulting file is consumed by nginx via auth_basic_user_file.
+  sops.secrets.vtimeline-htpasswd = {
+    format = "yaml";
+    key = "passwords";
+    sopsFile = ./secrets/vtimeline-htpasswd.yaml;
+    owner = "nginx";
+    group = "nginx";
+    mode = "0640";
+  };
 }
diff --git a/modules/server/secrets/vtimeline-htpasswd.yaml b/modules/server/secrets/vtimeline-htpasswd.yaml
new file mode 100644
index 0000000..5ebd2c0
--- /dev/null
+++ b/modules/server/secrets/vtimeline-htpasswd.yaml
@@ -0,0 +1,25 @@
+#ENC[AES256_GCM,data:UW49BNUTjSgrBCXW4f5/7lJPUqXZp1U1iFHEvR4QOGm9KWPwAqYTg+i4I2dWeMTP4PqkFA8ry+TtFUHV+UTyEJxMbTZPSaqXJmQAh7k07Trv17snVEtvotzTHn5yjZwAVvPi,iv:/H/FXmF0n86xlE4wA/oBioEYJkc14+mLzSL61qJk1z8=,tag:kbCFXytipQ+FTP1OiHfO8w==,type:comment]
+#ENC[AES256_GCM,data:OWEZavcPrsSst1YUaspDqXeYx1HTLsw2zT9j2ao8mmxrgjgVJ2teclWQT6R8D9OxMwVh/Cbd25XtwwsgWpwMzQChSAD4oFPofvujpFHhndwuuyA12kA/rGRp6oLF5ZVavFR/4oTjm6xDE6AlwgKsT64=,iv:15ZKD0tvJFbRLaX/KclDaUc7TstivGItyTxmN81HVCQ=,tag:9871kdKv+GhH1/Gyy/oYPg==,type:comment]
+#
+#ENC[AES256_GCM,data:6P4BRz2PQ76929PaDFp9KHXKgVx9C6FncoQBx7ia/GfeR86O/ZCtf9k=,iv:SNSpMmo4LqxHl3WE0VeW9gyJLfTwhrlLgbpHNgM/zuI=,tag:M2b8hGlAUOro8Pk79YV3mA==,type:comment]
+#ENC[AES256_GCM,data:1uTKcKavRm0dgeTKk4ReXSzxd6hUfQ2NxvKbtME1kJRWeyUuS/H2DYRXYWLun6O/xXA=,iv:1Fo5dTDuJXRkfTjPvCNRLzPgVcusZXB/S5TVimqPQb4=,tag:jfdXqAfsE2DCyfRdJFS70w==,type:comment]
+#ENC[AES256_GCM,data:OIyr3AEEKrU73nHK3X5vJ6+YkBCvDVBnXYiEkI/yutRMASnP6ZBc1DmLxV+bWKS7d1aJxA2k3S+/IKN9UhwSa6AfR8iuvLSFnkMZlgOyulTb+I1Qdg==,iv:ZjLfBkAjJT99k3c1qtRglQuwoA8eVGtoHjJJNtHsqpQ=,tag:RYdq29YgqoFzzEwU0UQ5Vw==,type:comment]
+#
+#ENC[AES256_GCM,data:WGLSnMuM1Kj6V/bUSZKQVdu3M3SmR7ADrQK0WuGufRmg1Z2q/I8eeP3mKFkk9EobYV7fHab34B7CCDMtQemcvV92lF4+e59ggfxP53nrVsLh8ZWIxJycneY=,iv:UUQZkq+WP8muG0XUN1TJ4fz6Hen54JO+4of/YiFamEE=,tag:Zac0l31mULvA/2p2GJBfGg==,type:comment]
+#ENC[AES256_GCM,data:sXr+q5pUauY1atCv5H0X1C53b8pnO0yKwb6EbizJkTqmoajaSu/rp4vtfZ1eWOffyNwrUZoGsB4kauT75H/kpEJ3V+g0Hizu7JozxLji9hUdugfbQKFFqbD/cm+ctj70GpY=,iv:YclhEQ+sX6ae+y8KVgut53oQlVCKAm9T8J3xMM9r174=,tag:/tZucqVbVLPeCi4re3x4ZQ==,type:comment]
+passwords: ENC[AES256_GCM,data:s49DRPQO5DcFeZQGwBQ01Eh7mgSVCrPl2u3On3msqPmm/VRBst4RigDFS6xKzPPSHbkinLMGxkOhXPuegGPzRgs=,iv:XBuodKnec/qNsPXXDKCsVgTl39EgZZvWsyRPZ6lN9m0=,tag:nO9MWneybijH9ZIeXGPQVw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDWXliaFM4RkFmZE1yM0N1
+            blJnTmp3Q2p2ZHM3THlyUGpQckNEcC9EZ2c0CkFxU0pUTmVHNDZXYS9STDVTamIr
+            M3A4VlAzdzFEYTUydGF2T01DNFkxT0EKLS0tIDlSS2s1YjF4TmkveHd4LzBRbTI4
+            anhpeUZ1VUFXYWVObTU2YVpCaTFXN00KwMHeXtaKxMpdLPRANabj+Vpxx5WLsyPW
+            T9npuQcI52YaXuNpUy+MtWNASwSXvmA7nl4KJNLCWAhgGKrd48Hwxw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+    lastmodified: "2026-10-07T14:31:12Z"
+    mac: ENC[AES256_GCM,data:nu44CjCVES+B+UI+6xwT3fCEN958FuKH7eHUTr+XEoHEGfh2Nx+5G5VciJD1TcsQ9yb0C1uWEGkCH8wrjcUEEDNe9MPVGqsREV7fpmO9Cr0wrW5Ji8gnbTGTjI7GswoYG3jUtMzdktBJnX8g6vit2VE7s9l+mE2S3YH3RXyHBDE=,iv:iff4ebSxNFumw1b82FEd0IdWBHGMOowG3LTQui7wTyg=,tag:TGhNeml/F9vtMrJm7d6MJA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3