feat(webserver): Vendor and reimplement main pages in leptos

configuration/default.nix

@@ -8,7 +8,6 @@
   imports = [
     flake-inputs.disko.nixosModules.disko
     flake-inputs.sops-nix.nixosModules.sops
-    flake-inputs.tlaternet-webserver.nixosModules.default
     "${modulesPath}/profiles/minimal.nix"
 
     ../modules

configuration/services/webserver.nix

@@ -1,4 +1,10 @@
-{ config, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  flake-inputs,
+  ...
+}:
 let
   inherit (config.services.nginx) domain;
 in
@@ -8,11 +14,50 @@ in
     443
   ];
 
-  services.tlaternet-webserver = {
-    enable = true;
-    listen = {
-      addr = "127.0.0.1";
-      port = 8000;
+  systemd.services.tlaternet-webserver = {
+    description = "tlater.net webserver";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+
+    script = ''
+      ${lib.getExe flake-inputs.self.packages.${pkgs.system}.webserver}
+    '';
+
+    environment = {
+      TLATERNET_NTFY_INSTANCE = "https://tlater.net";
+      LEPTOS_SITE_ADDR = "127.0.0.1:8000";
+    };
+
+    serviceConfig = {
+      Type = "exec";
+      LoadCredential = "ntfy-topic:/run/secrets/tlaternet/ntfy-topic";
+
+      DynamicUser = true;
+      ProtectHome = true; # Override the default (read-only)
+      PrivateDevices = true;
+      PrivateIPC = true;
+      PrivateUsers = true;
+      ProtectHostname = true;
+      ProtectClock = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectKernelLogs = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [
+        "AF_UNIX"
+        "AF_INET"
+        "AF_INET6"
+      ];
+      RestrictNamespaces = true;
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged @resources @setuid @keyring"
+      ];
     };
   };
 
@@ -28,6 +73,11 @@ in
       useACMEHost = "tlater.net";
       enableHSTS = true;
 
-      locations."/".proxyPass = "http://${addr}:${toString port}";
+      locations."/".proxyPass =
+        "http://${config.systemd.services.tlaternet-webserver.environment.LEPTOS_SITE_ADDR}";
     };
+
+  sops.secrets = {
+    "tlaternet/ntfy-topic" = { };
+  };
 }