From ec60ef02e12dde27a483824b85a77dddc7521594 Mon Sep 17 00:00:00 2001
From: Charlotte Hartmann Paludo <git@charlotteharludo.com>
Date: Tue, 21 Oct 2025 10:13:00 +0200
Subject: [PATCH] nixos/bentopdf: init

---
 .../manual/release-notes/rl-2605.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 nixos/modules/services/web-apps/bentopdf.nix  | 112 ++++++++++++++++++
 3 files changed, 115 insertions(+)
 create mode 100644 nixos/modules/services/web-apps/bentopdf.nix

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 6cf6e5f1c1d1..a5a1d534cda6 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -30,6 +30,8 @@
 
 - [nohang](https://github.com/hakavlad/nohang), a daemon for Linux that prevents out of memory (OOM) situations from affecting system responsiveness. Available as [services.nohang](#opt-services.nohang.enable)
 
+- [bentopdf](https://github.com/alam00000/bentopdf), a privacy-first PDF toolkit running completely in-browser. Available as [services.bentopdf](#opt-services.bentopdf.enable).
+
 - [DankMaterialShell](https://danklinux.com), a complete desktop shell for Wayland compositors built with Quickshell. Available as [programs.dms-shell](#opt-programs.dms-shell.enable).
 
 - [dms-greeter](https://danklinux.com), a modern display manager greeter for DankMaterialShell that works with greetd and supports multiple Wayland compositors. Available as [services.displayManager.dms-greeter](#opt-services.displayManager.dms-greeter.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index cdd258e5b176..a4b56da0c5d9 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1586,6 +1586,7 @@
   ./services/web-apps/artalk.nix
   ./services/web-apps/audiobookshelf.nix
   ./services/web-apps/baikal.nix
+  ./services/web-apps/bentopdf.nix
   ./services/web-apps/bluemap.nix
   ./services/web-apps/bluesky-pds.nix
   ./services/web-apps/bookstack.nix
diff --git a/nixos/modules/services/web-apps/bentopdf.nix b/nixos/modules/services/web-apps/bentopdf.nix
new file mode 100644
index 000000000000..651896c41ea4
--- /dev/null
+++ b/nixos/modules/services/web-apps/bentopdf.nix
@@ -0,0 +1,112 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.bentopdf;
+in
+{
+  options.services.bentopdf = {
+    enable = lib.mkEnableOption "bentopdf Privacy First PDF Toolkit";
+
+    package = lib.mkPackageOption pkgs "bentopdf" {
+      extraDescription = ''
+        To use the "normal mode" variant of bentopdf, which includes all socials, marketing and explanatory texts, set this option to `pkgs.bentopdf.override { simpleMode = false; }`.
+      '';
+    };
+
+    domain = lib.mkOption {
+      description = "Domain to use for the virtual host.";
+      type = lib.types.str;
+    };
+
+    nginx = {
+      enable = lib.mkEnableOption "a virtualhost to serve bentopdf through nginx";
+
+      virtualHost = lib.mkOption {
+        type = lib.types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+        default = { };
+        example = lib.literalExpression ''
+          {
+            serverAliases = [ "bentopdf.''${config.networking.domain}" ];
+          }
+        '';
+        description = "Extra configuration for the nginx virtual host of bentopdf.";
+      };
+    };
+
+    caddy = {
+      enable = lib.mkEnableOption "a virtualhost to serve bentopdf through caddy";
+
+      virtualHost = lib.mkOption {
+        type = lib.types.submodule (
+          import ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
+        );
+        default = { };
+        example = lib.literalExpression ''
+          {
+            serverAliases = [ "bentopdf.''${config.networking.domain}" ];
+          }
+        '';
+        description = "Extra configuration for the caddy virtual host of bentopdf.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nginx = lib.mkIf cfg.nginx.enable {
+      enable = lib.mkDefault true;
+      virtualHosts."${cfg.domain}" = lib.mkMerge [
+        cfg.nginx.virtualHost
+        {
+          root = lib.mkForce "${cfg.package}";
+
+          locations."/" = {
+            index = "index.html";
+            extraConfig = ''
+              try_files $uri $uri/ /index.html;
+            '';
+          };
+
+          locations."~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$".extraConfig = ''
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+          '';
+        }
+      ];
+    };
+
+    services.caddy = lib.mkIf cfg.caddy.enable {
+      enable = lib.mkDefault true;
+      virtualHosts."${cfg.domain}" = lib.mkMerge [
+        cfg.caddy.virtualHost
+        {
+          hostName = lib.mkForce cfg.domain;
+          extraConfig = ''
+            root * ${cfg.package}
+            try_files {path} /index.html
+            file_server
+
+            @static {
+              path_regexp static \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$
+            }
+            handle @static {
+              header {
+                Cache-Control "public, immutable"
+              }
+              header Cache-Control max-age=31536000
+            }
+          '';
+        }
+      ];
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    charludo
+    stunkymonkey
+  ];
+}