From 58ec2867859613da33cf08e674f70224335c42eb Mon Sep 17 00:00:00 2001
From: Jean-Baptiste Giraudeau <jb@giraudeau.info>
Date: Mon, 9 Sep 2024 14:25:07 +0200
Subject: [PATCH 1/3] nixos/gancio: actually enable ssl by default.

---
 nixos/modules/services/web-apps/gancio.nix | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/web-apps/gancio.nix b/nixos/modules/services/web-apps/gancio.nix
index 0a2db3bce5f8..893f5702518a 100644
--- a/nixos/modules/services/web-apps/gancio.nix
+++ b/nixos/modules/services/web-apps/gancio.nix
@@ -157,11 +157,18 @@ in
     };
 
     nginx = mkOption {
-      type = types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+      type = types.submodule (
+        lib.recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {
+          # enable encryption by default,
+          # as sensitive login credentials should not be transmitted in clear text.
+          options.forceSSL.default = true;
+          options.enableACME.default = true;
+        }
+      );
       default = { };
       example = {
-        enableACME = true;
-        forceSSL = true;
+        enableACME = false;
+        forceSSL = false;
       };
       description = "Extra configuration for the nginx virtual host of gancio.";
     };
@@ -260,8 +267,6 @@ in
       virtualHosts."${cfg.settings.hostname}" = mkMerge [
         cfg.nginx
         {
-          enableACME = mkDefault true;
-          forceSSL = mkDefault true;
           locations = {
             "/" = {
               index = "index.html";

From 432bfec0264157e5485768897a70b5193c2015a7 Mon Sep 17 00:00:00 2001
From: Jean-Baptiste Giraudeau <jb@giraudeau.info>
Date: Mon, 9 Sep 2024 15:20:59 +0200
Subject: [PATCH 2/3] nixos/gancio: use unix socket between nginx and gancio

---
 nixos/modules/services/web-apps/gancio.nix | 25 +++++++++++-----------
 nixos/tests/gancio.nix                     |  2 +-
 2 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/nixos/modules/services/web-apps/gancio.nix b/nixos/modules/services/web-apps/gancio.nix
index 893f5702518a..5f14ff46cb19 100644
--- a/nixos/modules/services/web-apps/gancio.nix
+++ b/nixos/modules/services/web-apps/gancio.nix
@@ -59,19 +59,12 @@ in
             description = "The URL path under which the server is reachable.";
           };
           server = {
-            host = mkOption {
-              type = types.str;
-              default = "localhost";
-              example = "::";
+            socket = mkOption {
+              type = types.path;
+              readOnly = true;
+              default = "/run/gancio/socket";
               description = ''
-                The address (IPv4, IPv6 or DNS) for the gancio server to listen on.
-              '';
-            };
-            port = mkOption {
-              type = types.port;
-              default = 13120;
-              description = ''
-                Port number of the gancio server to listen on.
+                The unix socket for the gancio server to listen on.
               '';
             };
           };
@@ -231,6 +224,10 @@ in
 
         serviceConfig = {
           ExecStart = "${getExe cfg.package} start ${configFile}";
+          # set umask so that nginx can write to the server socket
+          # FIXME: upstream socket permission configuration in Nuxt
+          UMask = "0002";
+          RuntimeDirectory = "gancio";
           StateDirectory = "gancio";
           WorkingDirectory = "/var/lib/gancio";
           LogsDirectory = "gancio";
@@ -274,12 +271,14 @@ in
             };
             "@proxy" = {
               proxyWebsockets = true;
-              proxyPass = "http://${cfg.settings.server.host}:${toString cfg.settings.server.port}";
+              proxyPass = "http://unix:${cfg.settings.server.socket}";
               recommendedProxySettings = true;
             };
           };
         }
       ];
     };
+    # for nginx to access gancio socket
+    users.users."${config.services.nginx.user}".extraGroups = [ config.users.users.${cfg.user}.group ];
   };
 }
diff --git a/nixos/tests/gancio.nix b/nixos/tests/gancio.nix
index 1dc5fd8b5606..8f4696d6f6cc 100644
--- a/nixos/tests/gancio.nix
+++ b/nixos/tests/gancio.nix
@@ -71,7 +71,7 @@ import ./make-test-python.nix (
       server.wait_for_unit("postgresql")
       server.wait_for_unit("gancio")
       server.wait_for_unit("nginx")
-      server.wait_for_open_port(13120)
+      server.wait_for_file("/run/gancio/socket")
       server.wait_for_open_port(80)
 
       # Check can create user via cli

From 3a33b6c3a846f3abca1e18d09563579b5081f6ac Mon Sep 17 00:00:00 2001
From: Jean-Baptiste Giraudeau <jb@giraudeau.info>
Date: Tue, 10 Sep 2024 09:31:35 +0200
Subject: [PATCH 3/3] nixos/gancio: set default value for settings.baseurl

---
 nixos/modules/services/web-apps/gancio.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/web-apps/gancio.nix b/nixos/modules/services/web-apps/gancio.nix
index 5f14ff46cb19..fa55db762c46 100644
--- a/nixos/modules/services/web-apps/gancio.nix
+++ b/nixos/modules/services/web-apps/gancio.nix
@@ -54,9 +54,12 @@ in
           };
           baseurl = mkOption {
             type = types.str;
-            default = "";
-            example = "/gancio";
-            description = "The URL path under which the server is reachable.";
+            default = "http${
+              lib.optionalString config.services.nginx.virtualHosts."${cfg.settings.hostname}".enableACME "s"
+            }://${cfg.settings.hostname}";
+            defaultText = lib.literalExpression ''"https://''${cfg.settings.hostname}"'';
+            example = "https://demo.gancio.org/gancio";
+            description = "The full URL under which the server is reachable.";
           };
           server = {
             socket = mkOption {