add yisroelbaum web stack module

nix/tests/module.nix

@@ -0,0 +1,82 @@
+{
+  nixpkgs,
+  self,
+  system,
+}:
+let
+  pkgs = nixpkgs.legacyPackages.${system};
+  evaluatedSystem = nixpkgs.lib.nixosSystem {
+    inherit system;
+    modules = [
+      self.nixosModules.default
+      {
+        system.stateVersion = "25.11";
+        services.yisroelbaum-web = {
+          enable = true;
+          secretFiles = {
+            borgPassphrase = "/run/secrets/borg-passphrase";
+            borgPrivateKey = "/run/secrets/borg-private-key";
+            forgejoMailerUser = "/run/secrets/forgejo-mailer-user";
+            forgejoMailerPassword = "/run/secrets/forgejo-mailer-password";
+            rabbiGerziEnvironment = "/run/secrets/rabbi-gerzi.env";
+          };
+        };
+      }
+    ];
+  };
+  evaluatedConfig = evaluatedSystem.config;
+  virtualHosts = evaluatedConfig.services.nginx.virtualHosts;
+  certificates = evaluatedConfig.security.acme.certs;
+  forgejoBackup = evaluatedConfig.services.borgbackup.jobs.forgejo;
+  forgejoBackupService = evaluatedConfig.systemd.services.borgbackup-job-forgejo;
+  publicHostNames = [
+    "yisroelbaum.com"
+    "jellyfin.yisroelbaum.com"
+    "git.yisroelbaum.com"
+    "rabbigerzi.yisroelbaum.com"
+    "rabbigerziapi.yisroelbaum.com"
+  ];
+in
+assert evaluatedConfig.services.nginx.enable;
+assert evaluatedConfig.services.jellyfin.enable;
+assert evaluatedConfig.services.forgejo.enable;
+assert evaluatedConfig.services.rabbi-gerzi.enable;
+assert
+  virtualHosts."yisroelbaum.com".locations."/".root
+  == "${self.inputs.resume.packages.${system}.default}";
+assert virtualHosts."jellyfin.yisroelbaum.com".locations."/".proxyPass == "http://localhost:8096";
+assert virtualHosts."git.yisroelbaum.com".locations."/".proxyPass == "http://127.0.0.1:3000";
+assert !virtualHosts."git.yisroelbaum.com".locations."/".recommendedProxySettings;
+assert nixpkgs.lib.hasInfix "proxy_set_header X-Forwarded-Proto $scheme;"
+  virtualHosts."git.yisroelbaum.com".locations."/".extraConfig;
+assert builtins.all (
+  hostName:
+  virtualHosts.${hostName}.forceSSL
+  && virtualHosts.${hostName}.enableACME
+  && certificates.${hostName}.domain == hostName
+) publicHostNames;
+assert builtins.all (certificate: !(nixpkgs.lib.hasPrefix "*." certificate.domain)) (
+  builtins.attrValues certificates
+);
+assert evaluatedConfig.services.forgejo.settings.server.ROOT_URL == "https://git.yisroelbaum.com/";
+assert evaluatedConfig.services.forgejo.settings.server.DOMAIN == "git.yisroelbaum.com";
+assert evaluatedConfig.services.forgejo.settings.server.SSH_PORT == 2222;
+assert evaluatedConfig.services.forgejo.settings.mailer.FROM == "me@yisroelbaum.com";
+assert evaluatedConfig.services.forgejo.secrets.mailer.USER == "/run/secrets/forgejo-mailer-user";
+assert
+  evaluatedConfig.services.forgejo.secrets.mailer.PASSWD == "/run/secrets/forgejo-mailer-password";
+assert evaluatedConfig.services.rabbi-gerzi.frontend.hostName == "rabbigerzi.yisroelbaum.com";
+assert evaluatedConfig.services.rabbi-gerzi.backend.hostName == "rabbigerziapi.yisroelbaum.com";
+assert
+  evaluatedConfig.services.rabbi-gerzi.backend.environmentFile == "/run/secrets/rabbi-gerzi.env";
+assert forgejoBackup.repo == "ssh://n5lniyfd@n5lniyfd.repo.borgbase.com/./repo";
+assert forgejoBackup.startAt == "*-*-* 03:15:00";
+assert forgejoBackup.persistentTimer;
+assert forgejoBackup.prune.keep.daily == 7;
+assert forgejoBackup.prune.keep.weekly == 4;
+assert forgejoBackup.prune.keep.monthly == 6;
+assert builtins.elem evaluatedConfig.services.forgejo.stateDir forgejoBackup.paths;
+assert builtins.elem "sops-install-secrets.service" forgejoBackupService.after;
+pkgs.runCommand "yisroelbaum-web-module-eval" { } ''
+  touch "$out"
+''