Site without podman

site.nix

@@ -7,39 +7,51 @@ let
     vendorHash = "sha256-H8Wa1GoXjU8mkaE0ofdA1mO+rNo3l4s0nxTVih9LuWs=";
   };
 
+  buildScript = ''
+      rev=$(git ls-remote https://git.orga.cebula.camp/infra/site | grep refs/heads/nix | cut -f1)
+      pkg=$(nix-build -I nixpkgs=${pkgs.path} --no-out-link -E 'import (builtins.fetchGit { url = "https://git.orga.cebula.camp/infra/site"; rev="'$rev'"; })')
+  '';
 in {
-  virtualisation.podman.enable = true;
-  virtualisation.oci-containers.backend = "podman";
-  virtualisation.oci-containers.containers = {
-    site = {
-      image = "git.orga.cebula.camp/infra/site:golden";
-      ports = [ "10.88.0.1:9001:3000" ];
-    };
-  };
   services.nginx.virtualHosts."cebula.camp" = {
     forceSSL = true;
     enableACME = true;
     locations."/" = {
-      proxyPass = "http://10.88.0.1:9001/";
+      proxyPass = "http://localhost:3000/";
       proxyWebsockets = true;
     };
-  };
-  systemd.timers.site-autodeploy = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnBootSec = "5m";
-      OnUnitActiveSec = "5m";
-      Unit = "site-autodeploy.service";
+    locations."/.not-well-known/update" = {
+      proxyPass = "http://unix:/run/site-autodeploy.sock";
+      extraConfig = ''
+        proxy_http_version 1.0;
+      '';
     };
   };
-  systemd.services.site-autodeploy = {
-    path = [ pkgs.podman pkgs.bash ];
+  systemd.sockets.site-autodeploy = {
+    wantedBy = [ "sockets.target" ];
+    socketConfig = {
+      ListenStream = "/run/site-autodeploy.sock";
+      SocketMode = "0600";
+      SocketUser = config.services.nginx.user;
+      Accept = true;
+      MaxConnections=1;
+    };
+  };
+  systemd.services."site-autodeploy@" = {
+    path = [ pkgs.git pkgs.nix pkgs.bash pkgs.systemd ];
     script = ''
       set -eu
-      ${autodeploy}/bin/autodeploy \
-        -local_checkout /root/site-ci \
-        -trigger "systemctl restart podman-site"
+      rev=$(git ls-remote https://git.orga.cebula.camp/infra/site | grep refs/heads/nix | cut -f1)
+      if [ -n "$(nix-build --dry-run -I nixpkgs=${pkgs.path} -E 'import (builtins.fetchGit { url = "https://git.orga.cebula.camp/infra/site"; rev="'$rev'"; })' 2>&1)" ]; then
+        echo -e "HTTP/1.0 200 Ok\r\n\r\n\r\n"
+        ${buildScript}
+        systemctl restart cebula-site
+      else
+        echo -e "HTTP/1.0 304 Not Modified\r\nContent-Length: 0\r\n\r\n"
+      fi
     '';
+    unitConfig = {
+      CollectMode="inactive-or-failed";
+    };
     serviceConfig = {
       Type = "oneshot";
       # TODO: run as an unprivileged user:
@@ -47,6 +59,15 @@ in {
       #    subuid/subgid maps with LDAP.
       # 2. let the unprivileged user sudo into a systemctl unit restart
       User = "root";
+      StandardOutput = "socket";
     };
   };
+  systemd.services.cebula-site = {
+    wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.git pkgs.nix pkgs.bash ];
+    script = ''
+      ${buildScript}
+      exec $pkg/bin/cebula-site
+    '';
+  };
 }