Initial import of HortusFox Nix flake packaging

Packages HortusFox from source via php.buildComposerProject and provides
a NixOS module (services.hortusfox-web) to deploy it as a full service
(mariadb + phpfpm + nginx/caddy + ACME + cron timers).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/default.nix

@@ -0,0 +1,49 @@
+{ pkgs, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+    ../nixos-module
+  ];
+
+  #nixpkgs.config.allowUnfree = true;
+
+  # `nix flake check` builds config.system.build.toplevel (a fully bootable
+  # system), even though this config is only ever meant to be built as
+  # `.config.system.build.vm` (see justfile). These satisfy its assertions
+  # without affecting the VM build itself.
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+  boot.loader.grub.devices = [ "/dev/vda" ];
+
+  # Required by services.hortusfox-web's forceSSL+enableACME nginx vhost.
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "test@example.invalid";
+  };
+
+  users.users.root.initialPassword = "toor";
+
+  services.hortusfox-web = {
+    enable = true;
+    proxy.server = "nginx";
+    # No real domain/internet-reachable cert here, so serve plain HTTP --
+    # otherwise forceSSL+enableACME breaks the VM (see justfile's hostfwd
+    # to test over http://localhost:8080/).
+    proxy.ssl = false;
+    # Matches justfile's hostfwd (host 127.0.0.1:8080 -> guest 80), so
+    # login/session redirects land back on the forwarded port instead of
+    # the guest's own (unforwarded) port 80.
+    port = 8080;
+    adminAccount.passwordFile = ./hortusfox_web_test_password;
+    secretFile = ./test.env;
+    settings.APP_DEBUG = true;
+  };
+
+  networking.firewall.enable = false;
+
+  services.resolved.enable = true;
+}
+

tests/hortusfox_web_test_password

@@ -0,0 +1 @@
+password

tests/test.env

@@ -0,0 +1,2 @@
+APP_KEY=base64:gJnNI8pOx4c0/Z6kl9mIjn0X9XkbJUWjtqnDFl9prvo=
+API_KEY=test-api-token

tests/vm-test.nix

@@ -0,0 +1,96 @@
+# One nixosTest per proxy backend: boots the service, waits for the
+# backend-specific web server unit, and exercises both a dynamic (PHP-FPM)
+# and a static (nginx/caddy's own) request path. Called once per backend
+# from flake.nix's `checks`.
+{ pkgs, nixosModule, proxyServer }:
+
+let
+  # Known plaintext, embedded directly into the curl login POST below --
+  # this is a throwaway test VM's password, not a real secret.
+  adminPassword = "correct-horse-battery-staple";
+in
+
+pkgs.testers.nixosTest {
+  name = "hortusfox-web-${proxyServer}";
+
+  nodes.machine = {
+    imports = [ nixosModule ];
+
+    services.hortusfox-web = {
+      enable = true;
+      proxy.server = proxyServer;
+      proxy.ssl = false; # no internet/ACME inside the test VM
+      settings.APP_DEBUG = true; # required for `php asatru migrate:*` to run
+      adminAccount.passwordFile = pkgs.writeText "hortusfox-test-admin-password" adminPassword;
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("mysql.service")
+    machine.wait_for_unit("hortusfox-setup.service")
+    machine.wait_for_unit("phpfpm-hortusfox.service")
+    machine.wait_for_unit("${proxyServer}.service")
+    machine.wait_for_open_port(80)
+    # -L: "/" redirects to the login page (/auth) for a logged-out
+    # user -- following it is what actually exercises the page that
+    # broke before (a bare "/" 302 response has no exception text
+    # to catch).
+    response = machine.succeed("curl -sfL http://localhost/")
+
+    # A <400 response alone isn't enough -- Asatru renders uncaught
+    # exceptions as HTML without failing the HTTP status, so a plain
+    # `curl -sf` above would happily "succeed" on a broken app (this
+    # is exactly how the runtime-tree symlink-vs-copy bug slipped
+    # past this check before). Fail loudly on that page instead.
+    assert "Asatru PHP - Exception" not in response, (
+        f"got an Asatru exception page instead of the real site:\n{response}"
+    )
+
+    # Also fetch a real static asset directly (the proxy's own job, not
+    # PHP-FPM's) -- the login page's background image, which ships in
+    # the package itself. This is what actually exercises the proxy
+    # reading into stateDir's writable subdirs (public/img here), as
+    # opposed to the runtime tree checked above.
+    machine.succeed("curl -sf http://localhost/img/pattern.jpg -o /dev/null")
+
+    # PHP-FPM runs as the hortusfox user and can serve pages even when
+    # the proxy (a different user) can't read the runtime tree at all --
+    # so a passing response above doesn't rule this out on its own. Check
+    # the proxy's own log directly, and only after every request made so
+    # far, so a permission error on any of them (runtime tree or
+    # persistent state dir) gets caught here.
+    machine.fail("journalctl -u ${proxyServer} --no-pager | grep -qi 'permission denied'")
+
+    # Exercise the actual point of adminAccount.passwordFile: log in as the
+    # seeded admin, not just confirm a login form renders. migrate:fresh
+    # alone creates no user rows, so this is the only way any account gets
+    # to exist at all -- worth proving it actually works end to end.
+    machine.succeed(
+        "curl -sc /tmp/cookies -o /tmp/auth.html -L http://localhost/"
+    )
+    csrf_token = machine.succeed(
+        "sed -n 's/.*name=\"csrf_token\" value=\"\([^\"]*\)\".*/\\1/p' /tmp/auth.html | head -1"
+    ).strip()
+    assert csrf_token, "could not find a csrf_token on the /auth page"
+
+    # -w appends the final URL after a marker, so we can tell *where* we
+    # landed -- the dashboard itself also has a (normally hidden) change-
+    # password form in its markup, so checking for a password input isn't
+    # a reliable way to tell it apart from the login page.
+    raw = machine.succeed(
+        "curl -sb /tmp/cookies -c /tmp/cookies -L -w '\\n===URL===%{url_effective}' "
+        "--data-urlencode email=admin@localhost "
+        "--data-urlencode password=${adminPassword} "
+        f"--data-urlencode csrf_token={csrf_token} "
+        "--data-urlencode redirect=/ "
+        "http://localhost/login"
+    )
+    login_response, final_url = raw.rsplit("\n===URL===", 1)
+    assert "Asatru PHP - Exception" not in login_response, (
+        f"login crashed instead of succeeding:\n{login_response}"
+    )
+    assert "/auth" not in final_url, (
+        f"login didn't redirect away from /auth -- login failed (landed on {final_url}):\n{login_response}"
+    )
+  '';
+}