vhost connecting

modules/server/coredns.nix

@@ -26,6 +26,7 @@
               192.168.1.20 syncthing.zeroq.su
               192.168.1.20 talk.zeroq.su
               192.168.1.20 turn.zeroq.su
+              192.168.1.20 vtimeline.zeroq.su
               fallthrough
           }
           cache 300

modules/server/nginx.nix

@@ -123,6 +123,21 @@ in
         forceSSL = true;
         enableACME = true;
       };
+      # vtimeline.zeroq.su — static site behind HTTP basic auth.
+      # Files live under /home/oqyude/External/Git/VeeamTimelineView/public_html,
+      # which is bind-mounted to /var/lib/vtimeline (see systemd.mounts below)
+      # because /home/oqyude is mode 700 and the nginx user (uid 60) cannot
+      # traverse it. Credentials are pulled from sops; see the sops.secrets
+      # block at the bottom of this file.
+      "vtimeline.zeroq.su" = {
+        forceSSL = true;
+        enableACME = true;
+        root = "/var/lib/vtimeline";
+        extraConfig = ''
+          auth_basic "vtimeline";
+          auth_basic_user_file ${config.sops.secrets.vtimeline-htpasswd.path};
+        '';
+      };
       "pdf.private" = {
         forceSSL = false;
         enableACME = false;
@@ -251,4 +266,33 @@ in
     80
     443
   ];
+
+  # Bind-mount the vtimeline source tree into /var/lib so the nginx user
+  # (uid 60) doesn't have to traverse /home/oqyude (mode 700). The mount is
+  # lazy (x-systemd.automount) and nofail, so a missing /home/oqyude/External
+  # only shows up as a per-request 500/403, never as a hard boot failure.
+  systemd.mounts = [
+    (xlib.helpers.mkSystemdBind {
+      what = "/home/oqyude/External/Git/VeeamTimelineView/public_html";
+      where = "/var/lib/vtimeline";
+    })
+  ];
+  systemd.tmpfiles.rules = [
+    (xlib.helpers.mkTmpfile "d" "/var/lib/vtimeline" "0755" "nginx" "nginx")
+  ];
+
+  # htpasswd file for vtimeline.zeroq.su basic auth.
+  # Source layout (per modules/server/secrets/vtimeline-htpasswd.yaml):
+  #   passwords: |
+  #     <user>:<bcrypt-or-apr1-hash>
+  # sops-nix extracts the `passwords` key as the only decrypted content.
+  # The resulting file is consumed by nginx via auth_basic_user_file.
+  sops.secrets.vtimeline-htpasswd = {
+    format = "yaml";
+    key = "passwords";
+    sopsFile = ./secrets/vtimeline-htpasswd.yaml;
+    owner = "nginx";
+    group = "nginx";
+    mode = "0640";
+  };
 }

modules/server/secrets/vtimeline-htpasswd.yaml

@@ -0,0 +1,25 @@
+#ENC[AES256_GCM,data:UW49BNUTjSgrBCXW4f5/7lJPUqXZp1U1iFHEvR4QOGm9KWPwAqYTg+i4I2dWeMTP4PqkFA8ry+TtFUHV+UTyEJxMbTZPSaqXJmQAh7k07Trv17snVEtvotzTHn5yjZwAVvPi,iv:/H/FXmF0n86xlE4wA/oBioEYJkc14+mLzSL61qJk1z8=,tag:kbCFXytipQ+FTP1OiHfO8w==,type:comment]
+#ENC[AES256_GCM,data:OWEZavcPrsSst1YUaspDqXeYx1HTLsw2zT9j2ao8mmxrgjgVJ2teclWQT6R8D9OxMwVh/Cbd25XtwwsgWpwMzQChSAD4oFPofvujpFHhndwuuyA12kA/rGRp6oLF5ZVavFR/4oTjm6xDE6AlwgKsT64=,iv:15ZKD0tvJFbRLaX/KclDaUc7TstivGItyTxmN81HVCQ=,tag:9871kdKv+GhH1/Gyy/oYPg==,type:comment]
+#
+#ENC[AES256_GCM,data:6P4BRz2PQ76929PaDFp9KHXKgVx9C6FncoQBx7ia/GfeR86O/ZCtf9k=,iv:SNSpMmo4LqxHl3WE0VeW9gyJLfTwhrlLgbpHNgM/zuI=,tag:M2b8hGlAUOro8Pk79YV3mA==,type:comment]
+#ENC[AES256_GCM,data:1uTKcKavRm0dgeTKk4ReXSzxd6hUfQ2NxvKbtME1kJRWeyUuS/H2DYRXYWLun6O/xXA=,iv:1Fo5dTDuJXRkfTjPvCNRLzPgVcusZXB/S5TVimqPQb4=,tag:jfdXqAfsE2DCyfRdJFS70w==,type:comment]
+#ENC[AES256_GCM,data:OIyr3AEEKrU73nHK3X5vJ6+YkBCvDVBnXYiEkI/yutRMASnP6ZBc1DmLxV+bWKS7d1aJxA2k3S+/IKN9UhwSa6AfR8iuvLSFnkMZlgOyulTb+I1Qdg==,iv:ZjLfBkAjJT99k3c1qtRglQuwoA8eVGtoHjJJNtHsqpQ=,tag:RYdq29YgqoFzzEwU0UQ5Vw==,type:comment]
+#
+#ENC[AES256_GCM,data:WGLSnMuM1Kj6V/bUSZKQVdu3M3SmR7ADrQK0WuGufRmg1Z2q/I8eeP3mKFkk9EobYV7fHab34B7CCDMtQemcvV92lF4+e59ggfxP53nrVsLh8ZWIxJycneY=,iv:UUQZkq+WP8muG0XUN1TJ4fz6Hen54JO+4of/YiFamEE=,tag:Zac0l31mULvA/2p2GJBfGg==,type:comment]
+#ENC[AES256_GCM,data:sXr+q5pUauY1atCv5H0X1C53b8pnO0yKwb6EbizJkTqmoajaSu/rp4vtfZ1eWOffyNwrUZoGsB4kauT75H/kpEJ3V+g0Hizu7JozxLji9hUdugfbQKFFqbD/cm+ctj70GpY=,iv:YclhEQ+sX6ae+y8KVgut53oQlVCKAm9T8J3xMM9r174=,tag:/tZucqVbVLPeCi4re3x4ZQ==,type:comment]
+passwords: ENC[AES256_GCM,data:s49DRPQO5DcFeZQGwBQ01Eh7mgSVCrPl2u3On3msqPmm/VRBst4RigDFS6xKzPPSHbkinLMGxkOhXPuegGPzRgs=,iv:XBuodKnec/qNsPXXDKCsVgTl39EgZZvWsyRPZ6lN9m0=,tag:nO9MWneybijH9ZIeXGPQVw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDWXliaFM4RkFmZE1yM0N1
+            blJnTmp3Q2p2ZHM3THlyUGpQckNEcC9EZ2c0CkFxU0pUTmVHNDZXYS9STDVTamIr
+            M3A4VlAzdzFEYTUydGF2T01DNFkxT0EKLS0tIDlSS2s1YjF4TmkveHd4LzBRbTI4
+            anhpeUZ1VUFXYWVObTU2YVpCaTFXN00KwMHeXtaKxMpdLPRANabj+Vpxx5WLsyPW
+            T9npuQcI52YaXuNpUy+MtWNASwSXvmA7nl4KJNLCWAhgGKrd48Hwxw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+    lastmodified: "2026-10-07T14:31:12Z"
+    mac: ENC[AES256_GCM,data:nu44CjCVES+B+UI+6xwT3fCEN958FuKH7eHUTr+XEoHEGfh2Nx+5G5VciJD1TcsQ9yb0C1uWEGkCH8wrjcUEEDNe9MPVGqsREV7fpmO9Cr0wrW5Ji8gnbTGTjI7GswoYG3jUtMzdktBJnX8g6vit2VE7s9l+mE2S3YH3RXyHBDE=,iv:iff4ebSxNFumw1b82FEd0IdWBHGMOowG3LTQui7wTyg=,tag:TGhNeml/F9vtMrJm7d6MJA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3