feat(core): initialize NaxOS declarative NixOS distribution, modules, and ISO installer

2026-09-03 23:53:18 +02:00
parent 88a638955b
commit 5da58ae6d7
28 changed files with 2247 additions and 2 deletions
@@ -0,0 +1,72 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.naxos.ui;
+in {
+  options.services.naxos.ui = {
+    enable = mkEnableOption "NaxOS Web Dashboard Service";
+
+    port = mkOption {
+      type = types.port;
+      default = 80;
+      description = "Web interface listen port.";
+    };
+
+    sslPort = mkOption {
+      type = types.port;
+      default = 443;
+      description = "SSL/HTTPS listen port.";
+    };
+
+    staticPath = mkOption {
+      type = types.str;
+      default = "/opt/naxos/ui/dist";
+      description = "Path to compiled React/Vite web dashboard assets.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+
+      virtualHosts."naxos.local" = {
+        default = true;
+        listen = [
+          { addr = "0.0.0.0"; port = cfg.port; }
+          { addr = "[::]"; port = cfg.port; }
+        ];
+
+        # Serve Frontend SPA
+        locations."/" = {
+          root = cfg.staticPath;
+          tryFiles = "$uri $uri/ /index.html";
+        };
+
+        # Reverse Proxy to NaxOS API & WebSocket / SSE
+        locations."/api/" = {
+          proxyPass = "http://127.0.0.1:${toString config.services.naxos.api.port}/";
+          proxyWebsockets = true;
+          extraConfig = ''
+            proxy_buffering off;
+            proxy_cache off;
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+          '';
+        };
+
+        # Reverse Proxy to Perses Embedded Analytics
+        locations."/perses/" = {
+          proxyPass = "http://127.0.0.1:${toString config.services.naxos.perses.port}/";
+          proxyWebsockets = true;
+        };
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ cfg.port cfg.sslPort ];
+  };
+}