plausible: add to other services

hosts/best/cache/default.nix

@@ -10,7 +10,7 @@ in {
 
   secrets.nixServeKey = {
     file  = ./key.age;
-    owner = "nix-serve";
+    owner = "root"; # `nix-serve` runs as root.
   };
 
   services.nix-serve = enabled {

hosts/best/forgejo.nix

@@ -111,6 +111,10 @@ in {
   };
 
   services.nginx.virtualHosts.${fqdn} = merge config.services.nginx.sslTemplate {
+    extraConfig = ''
+      ${config.services.plausible.extraNginxConfigFor fqdn}
+    '';
+
     locations."/".proxyPass = "http://[::1]:${toString port}";
   };
 }

hosts/best/grafana/default.nix

@@ -77,6 +77,8 @@ in {
         # Grafana sets `nosniff` while not setting the content type properly,
         # so everything breaks with it. Unset the header.
         proxy_hide_header X-Content-Type-Options;
+
+        ${config.services.plausible.extraNginxConfigFor fqdn}
       '';
 
       proxyPass       = "http://[::1]:${toString port}";

hosts/best/matrix/default.nix

@@ -66,6 +66,7 @@ in {
       url_preview_enabled = true;
       dynamic_thumbnails = true;
 
+      enable_registration = false; # Setting it explicitly just in case.
       expire_access_token = true;
 
       # Trusting Matrix.org.

hosts/best/nextcloud/default.nix

@@ -111,6 +111,8 @@ in {
   };
 
   services.nginx.virtualHosts.${fqdn} = merge config.services.nginx.sslTemplate {
-    extraConfig = config.services.nginx.headers;    
+    extraConfig = ''
+      ${config.services.nginx.headers}
+    '';
   };
 }

hosts/best/plausible/default.nix

@@ -0,0 +1,48 @@
+{ config, self, lib, ... }: let
+  inherit (config.networking) domain;
+  inherit (lib) enabled merge mkConst;
+
+  fqdn = "shekels.${domain}";
+  port = 8007;
+in {
+  imports = [
+    (self + /modules/nginx.nix)
+    (self + /modules/postgresql.nix)
+  ];
+
+  config.secrets.plausibleKey = {
+    file  = ./key.age;
+    owner = "plausible";
+  };
+
+  config.services.postgresql.ensure = [ "plausible" ];
+
+  config.services.plausible = enabled {
+    server = {
+      disableRegistration = true; # Setting it explicitly just in case.
+
+      secretKeybaseFile = config.secrets.plausibleKey.path;
+
+      baseUrl = "https://${fqdn}";
+
+      listenAddress = "::1";
+      inherit port;
+    };
+  };
+
+  options.services.plausible.extraNginxConfigFor = mkConst /* nginx */ (domain: ''
+    proxy_set_header Accept-Encoding ""; # Substitution won't work if it is compressed.
+    sub_filter "</head>" '<script defer data-domain="${domain}" src="https://${fqdn}/js/script.js"></script></head>';
+    sub_filter_last_modified on;
+    sub_filter_once on;
+  '');
+
+  config.services.nginx.virtualHosts.${fqdn} = merge config.services.nginx.sslTemplate {
+    extraConfig = config.services.plausible.extraNginxConfigFor fqdn;
+
+    locations."/" = {
+      proxyPass       = "http://[::1]:${toString port}";
+      proxyWebsockets = true;
+    };
+  };
+}

hosts/best/plausible/key.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 8y3T6w 6z16kXAqAppYOMXQ7riHs+iP6SFMfJND1KlG0TI+Bgo
+Gm99zghsZ69nBzs8I+Hs3fRM7+dGEaNC7mFwVJZbjO4
+-> ssh-ed25519 CzqbPQ AYm8rfc18ftg7vvt6MVIYlaMcyL09VDoDBLGa0v6STo
+uWmdITsGHXPZfMMBDdaYkbLCHntii4mupaWklLfOYa0
+--- LFjB2mFBC6OkRoM7A9RVGjcXGbMQGKutBz44EDK3YJo
+ｰuL6lｸﾚ6eﾕ燗z<E78797>月ﾓE<EFBE93>'｢Gｺ殻逎､^xjﾉﾔj椴!YEsDZﾓy2紙ｦ<E7B499>rF
瀚Oｿ<4F>K<EFBFBD><4B>剰%ﾌ<>圦ﾈ^秉怖ﾎ<E68096>ｭﾐ┐ｨ∩ﾜY麩屍ﾄyI

modules/nginx.nix

@@ -16,7 +16,7 @@ in {
 
     add_header Strict-Transport-Security $hsts_header always;
 
-    add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'self'; base-uri 'self';" always;
+    add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' ${domain} *.${domain}; object-src 'self' ${domain} *.${domain}; base-uri 'self';" always;
 
     add_header Referrer-Policy no-referrer always;
 
@@ -52,6 +52,7 @@ in {
         https "max-age=31536000; includeSubdomains; preload";
       }
 
+      # FIXME: These two aren't working.
       map $http_origin $allow_origin {
         ~^https://.+\.${domain}$ $http_origin;
       }

modules/site.nix

@@ -2,6 +2,7 @@
   inherit (config.networking) domain;
   inherit (lib) enabled merge;
 
+  fqdn = domain;
   root = "/var/www/site";
 in {
   imports = [(self + /modules/nginx.nix)];
@@ -16,7 +17,7 @@ in {
       }
     '';
 
-    virtualHosts.${domain} = merge config.services.nginx.sslTemplate {
+    virtualHosts.${fqdn} = merge config.services.nginx.sslTemplate {
       inherit root;
 
       locations."/".tryFiles = "$uri $uri.html $uri/index.html =404";
@@ -29,6 +30,8 @@ in {
 
       extraConfig = /* nginx */ ''
         error_page 404 /404.html;
+
+        ${config.services.plausible.extraNginxConfigFor fqdn}
       '';
 
       locations."/404".extraConfig = /* nginx */ ''
@@ -36,12 +39,12 @@ in {
       '';
     };
 
-    virtualHosts."www.${domain}" = merge config.services.nginx.sslTemplate {
-      locations."/".return = "301 https://${domain}$request_uri";
+    virtualHosts."www.${fqdn}" = merge config.services.nginx.sslTemplate {
+      locations."/".return = "301 https://${fqdn}$request_uri";
     };
 
     virtualHosts._ = merge config.services.nginx.sslTemplate {
-      locations."/".return = "301 https://${domain}/404";
+      locations."/".return = "301 https://${fqdn}/404";
     };
   };
 }

secrets.nix

@@ -20,6 +20,8 @@ in {
 
   "hosts/best/nextcloud/password.age".publicKeys      = [ best ] ++ admins;
 
+  "hosts/best/plausible/key.age".publicKeys      = [ best ] ++ admins;
+
   # disk
   "hosts/disk/id.age".publicKeys              = [ disk ] ++ admins;
   "hosts/disk/password.age".publicKeys = [ disk ] ++ admins;