Initial import of HortusFox Nix flake packaging

Packages HortusFox from source via php.buildComposerProject and provides a NixOS module (services.hortusfox-web) to deploy it as a full service (mariadb + phpfpm + nginx/caddy + ACME + cron timers). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-27 17:14:22 -04:00
commit 38ec3c76f7
12 changed files with 919 additions and 0 deletions
@@ -0,0 +1,49 @@
+{ pkgs, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+    ../nixos-module
+  ];
+
+  #nixpkgs.config.allowUnfree = true;
+
+  # `nix flake check` builds config.system.build.toplevel (a fully bootable
+  # system), even though this config is only ever meant to be built as
+  # `.config.system.build.vm` (see justfile). These satisfy its assertions
+  # without affecting the VM build itself.
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+  boot.loader.grub.devices = [ "/dev/vda" ];
+
+  # Required by services.hortusfox-web's forceSSL+enableACME nginx vhost.
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "test@example.invalid";
+  };
+
+  users.users.root.initialPassword = "toor";
+
+  services.hortusfox-web = {
+    enable = true;
+    proxy.server = "nginx";
+    # No real domain/internet-reachable cert here, so serve plain HTTP --
+    # otherwise forceSSL+enableACME breaks the VM (see justfile's hostfwd
+    # to test over http://localhost:8080/).
+    proxy.ssl = false;
+    # Matches justfile's hostfwd (host 127.0.0.1:8080 -> guest 80), so
+    # login/session redirects land back on the forwarded port instead of
+    # the guest's own (unforwarded) port 80.
+    port = 8080;
+    adminAccount.passwordFile = ./hortusfox_web_test_password;
+    secretFile = ./test.env;
+    settings.APP_DEBUG = true;
+  };
+
+  networking.firewall.enable = false;
+
+  services.resolved.enable = true;
+}
+