import Rabbi Gerzi directly

README.md

@@ -6,7 +6,7 @@ nixos-rebuild switch --flake .#nixos \
 	--sudo --ask-sudo-password
 ```
 
-The public services under `yisroelbaum.com` are provided by the
+The main public services under `yisroelbaum.com` are provided by the
-`yisroelbaum-web` flake input. This repository owns the machine configuration
+`yisroelbaum-web` flake input. Rabbi Gerzi is imported directly from its own
-and provisions the runtime secrets passed to that module from
+flake so its application module remains independently owned. This repository
-`yisroelbaum-web.nix`.
+owns the machine configuration and provisions runtime secrets for both.

flake.lock

@@ -39,7 +39,6 @@
     "rabbi-gerzi": {
       "inputs": {
         "nixpkgs": [
-          "yisroelbaum-web",
           "nixpkgs"
         ],
         "utils": "utils"
@@ -83,6 +82,7 @@
       "inputs": {
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
+        "rabbi-gerzi": "rabbi-gerzi",
         "sops-nix": "sops-nix",
         "tide": "tide",
         "yisroelbaum-web": "yisroelbaum-web"
@@ -166,15 +166,14 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rabbi-gerzi": "rabbi-gerzi",
         "resume": "resume"
       },
       "locked": {
-        "lastModified": 1785486508,
+        "lastModified": 1785611752,
-        "narHash": "sha256-ERBDLfvLBz91IBMJeagoTfXzeldUjhekF8jqiuHCeGw=",
+        "narHash": "sha256-AC7EilGHueXmYK9gu+/EOw8wfL+Hv0bbjgKuBMvbPvA=",
         "ref": "refs/heads/master",
-        "rev": "b09be84f730937f9556263fc995753e873e31ac0",
+        "rev": "4a489e90f3af8d6eeb0ab0658c6e932253eaedc3",
-        "revCount": 2,
+        "revCount": 3,
         "type": "git",
         "url": "https://git.yisroelbaum.com/yisroelbaum/yisroelbaum-web"
       },

flake.nix

@@ -20,6 +20,10 @@
       url = "git+https://git.yisroelbaum.com/yisroelbaum/yisroelbaum-web";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    rabbi-gerzi = {
+      url = "git+https://git.yisroelbaum.com/yisroelbaum/Rabbi_Gerzi";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -30,6 +34,7 @@
       sops-nix,
       tide,
       yisroelbaum-web,
+      rabbi-gerzi,
       ...
     }:
     let
@@ -41,10 +46,12 @@
           ./configuration.nix
           ./tide.nix
           ./yisroelbaum-web.nix
+          ./rabbi-gerzi.nix
           home-manager.nixosModules.home-manager
           sops-nix.nixosModules.sops
           tide.nixosModules.tide
           yisroelbaum-web.nixosModules.default
+          rabbi-gerzi.nixosModules.default
           {
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;

rabbi-gerzi.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  ...
+}:
+{
+  services.rabbi-gerzi = {
+    enable = true;
+    frontend = {
+      hostName = "rabbigerzi.yisroelbaum.com";
+      nginx = {
+        forceSSL = true;
+        enableACME = true;
+      };
+    };
+    backend = {
+      hostName = "rabbigerziapi.yisroelbaum.com";
+      environmentFile = config.sops.secrets."rabbi-gerzi-env".path;
+      nginx = {
+        forceSSL = true;
+        enableACME = true;
+      };
+    };
+  };
+
+  sops.secrets."rabbi-gerzi-env" = {
+    sopsFile = ./secrets/rabbi-gerzi.env;
+    format = "dotenv";
+    key = "";
+    mode = "0400";
+    owner = config.services.rabbi-gerzi.user;
+    group = config.services.rabbi-gerzi.group;
+  };
+}

secrets/README.md

@@ -45,5 +45,4 @@ RABBI_GERZI_INITIAL_ADMIN_EMAIL=...
 RABBI_GERZI_INITIAL_ADMIN_PASSWORD=...
 ```
 
-The host passes this environment file to the Rabbi Gerzi service through the
+The host passes this environment file directly to the Rabbi Gerzi module.
-`yisroelbaum-web` module.

yisroelbaum-web.nix

@@ -7,7 +7,6 @@
       borgPrivateKey = config.sops.secrets."borg-private-key".path;
       forgejoMailerUser = config.sops.secrets."forgejo-mailer-user".path;
       forgejoMailerPassword = config.sops.secrets."forgejo-mailer-passwd".path;
-      rabbiGerziEnvironment = config.sops.secrets."rabbi-gerzi-env".path;
     };
   };
 
@@ -20,13 +19,5 @@
       sopsFile = ./secrets/forgejo.yaml;
       mode = "0400";
     };
-    "rabbi-gerzi-env" = {
-      sopsFile = ./secrets/rabbi-gerzi.env;
-      format = "dotenv";
-      key = "";
-      mode = "0400";
-      owner = config.services.rabbi-gerzi.user;
-      group = config.services.rabbi-gerzi.group;
-    };
   };
 }