add static landing page

nix/module.nix

@@ -6,6 +6,17 @@
 }:
 let
   cfg = config.services.tide;
+  landingPage = import ./site.nix { inherit pkgs; };
+  contentSecurityPolicy = lib.concatStringsSep " " [
+    "default-src 'self';"
+    "base-uri 'self';"
+    "font-src 'self';"
+    "form-action 'self';"
+    "frame-ancestors 'none';"
+    "img-src 'self' data:;"
+    "object-src 'none';"
+    "style-src 'self';"
+  ];
   dumpCommand = lib.concatStringsSep " " [
     "${config.services.postgresql.package}/bin/pg_dump"
     "--format=custom"
@@ -32,6 +43,25 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      virtualHosts."torahimderecheretz.com" = {
+        enableACME = true;
+        forceSSL = true;
+        root = landingPage;
+
+        locations."/" = {
+          tryFiles = "$uri $uri/ =404";
+          extraConfig = ''
+            add_header Content-Security-Policy "${contentSecurityPolicy}" always;
+            add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            add_header X-Content-Type-Options "nosniff" always;
+          '';
+        };
+      };
+    };
+
     services.discourse = {
       enable = true;
       admin = {

nix/site.nix

@@ -0,0 +1,18 @@
+{ pkgs }:
+
+pkgs.stdenvNoCC.mkDerivation {
+  pname = "tide-landing-page";
+  version = "1.0.0";
+  src = ../site;
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out"
+    cp -R . "$out"
+
+    runHook postInstall
+  '';
+}

nix/tests/module.nix

@@ -25,8 +25,7 @@ let
   };
   evaluatedConfig = evaluatedSystem.config;
   landingPage = self.packages.${system}.landing-page;
-  landingVirtualHost =
-    evaluatedConfig.services.nginx.virtualHosts."torahimderecheretz.com";
+  landingVirtualHost = evaluatedConfig.services.nginx.virtualHosts."torahimderecheretz.com";
   discourseConfig = evaluatedConfig.services.discourse;
   backupConfig = evaluatedConfig.services.borgbackup.jobs.discourse;
   backupService = evaluatedConfig.systemd.services.borgbackup-job-discourse;
@@ -37,10 +36,8 @@ assert discourseConfig.admin.email == "yisroel.d.baum@gmail.com";
 assert discourseConfig.admin.fullName == "Yisroel Baum";
 assert discourseConfig.admin.username == "yisroeldbaum";
 assert discourseConfig.admin.passwordFile == "/run/secrets/tide-admin-password";
-assert discourseConfig.mail.notificationEmailAddress ==
-  "system@torahimderecheretz.com";
-assert discourseConfig.mail.contactEmailAddress ==
-  "system@torahimderecheretz.com";
+assert discourseConfig.mail.notificationEmailAddress == "system@torahimderecheretz.com";
+assert discourseConfig.mail.contactEmailAddress == "system@torahimderecheretz.com";
 assert discourseConfig.mail.outgoing.passwordFile == "/run/secrets/tide-mail-password";
 assert discourseConfig.mail.outgoing.serverAddress == "in-v3.mailjet.com";
 assert discourseConfig.mail.outgoing.port == 587;
@@ -48,7 +45,7 @@ assert discourseConfig.mail.outgoing.authentication == "login";
 assert discourseConfig.siteSettings.required.title == "Torah Im Derech Eretz";
 assert discourseConfig.secretKeyBaseFile == "/run/secrets/tide-secret-key-base";
 assert evaluatedConfig.services.nginx.enable;
-assert landingVirtualHost.root == "${landingPage}";
+assert landingVirtualHost.root == landingPage;
 assert landingVirtualHost.enableACME;
 assert landingVirtualHost.forceSSL;
 assert landingVirtualHost.locations."/".tryFiles == "$uri $uri/ =404";
@@ -68,6 +65,7 @@ pkgs.runCommand "tide-module-test" { } ''
   test -f ${landingPage}/styles.css
   test -f ${landingPage}/robots.txt
   test -f ${landingPage}/assets/rav-hirsch-1847.jpg
+  test -f ${landingPage}/assets/rav-hirsch-1847.webp
   ${pkgs.gnugrep}/bin/grep -F \
     "A Torah vision for the whole of life." \
     ${landingPage}/index.html