From 7f3886c8367eba4d5ac0cdb01bcd2196c0d2ca8e Mon Sep 17 00:00:00 2001
From: Shea Levy <shea@shealevy.com>
Date: Wed, 13 Mar 2024 09:08:11 -0400
Subject: [PATCH 1/3] Add NixOS module for deployment

---
 flake.nix     |   2 +-
 nix/nixos.nix | 102 ++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+), 1 deletion(-)
 create mode 100644 nix/nixos.nix

diff --git a/flake.nix b/flake.nix
index e607cca53..8a7fce9d8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -51,9 +51,9 @@
       "openssl-1.1.1w"
       "python-2.7.18.7"
     ];
+    flake.nixosModules.default = import ./nix/nixos.nix inputs.self;
   };
 
-
   nixConfig = {
     extra-substituters = [
       "https://cache.iog.io"
diff --git a/nix/nixos.nix b/nix/nixos.nix
new file mode 100644
index 000000000..7eeb7e1c5
--- /dev/null
+++ b/nix/nixos.nix
@@ -0,0 +1,102 @@
+self: { lib, config, pkgs, ... }:
+let
+  inherit (lib) mkOption types mapAttrs';
+
+  playgroundOptions = { name, ... }: {
+    options = {
+      domain = mkOption {
+        type = types.str;
+        default = name;
+        description = "The domain to host the playground";
+      };
+
+      jwt-signature-file = mkOption {
+        type = types.path;
+        description = "A file containing a JWT signing token";
+      };
+
+      github-client-id = mkOption {
+        type = types.str;
+        description = "The GitHub OAuth application client ID";
+      };
+
+      github-client-secret-file = mkOption {
+        type = types.path;
+        description = "A file containing the GitHub OAuth application client secret";
+      };
+
+      flake = mkOption {
+        type = types.attrs;
+        default = self;
+        description = "A Nix Flake for the playground application";
+      };
+    };
+  };
+
+  cfg = config.marlowe.playgrounds;
+in
+{
+  options = {
+    marlowe.playgrounds = mkOption {
+      type = types.attrsOf (types.submodule playgroundOptions);
+      default = { };
+      description = "Marlowe Playground instances to run";
+    };
+  };
+  config = {
+    http-services.static-sites = mapAttrs'
+      (name: playground: {
+        name = "${name}-frontend";
+        value = {
+          inherit (playground) domain;
+          root = "${playground.flake.packages.x86_64-linux.marlowe-playground-client}/share/marlowe-playground-client/static";
+          index-fallback = true;
+        };
+      })
+      cfg;
+
+    http-services.proxied-services = mapAttrs'
+      (name: playground:
+        let
+          flakePkgs = playground.flake.packages.x86_64-linux;
+        in
+        {
+          name = "${name}-backend";
+          value = {
+            inherit (playground) domain;
+            prefix = "/api";
+            systemdConfig = port: {
+              description = "Marlowe Playground (${name})";
+              path = builtins.attrValues {
+                inherit (flakePkgs) ghc-with-marlowe;
+                inherit (pkgs) jq z3;
+              };
+              preStart = ''
+                jq -n \
+                  --rawfile ghClientSecret $CREDENTIALS_DIRECTORY/ghcs \
+                  --rawfile jwt $CREDENTIALS_DIRECTORY/jwt \
+                  --arg ghClientId ${lib.escapeShellArg playground.github-client-id} \
+                  --arg frontendUrl ${lib.escapeShellArg playground.domain} \
+                  '{ "github-client-id": $ghClientId
+                   , "github-client-secret": $ghClientSecret
+                   , "jwt-signature": $jwt
+                   , "frontend-url": $frontendUrl
+                   , "github-cb-path": "/#/gh-oauth-cb"
+                   }' > /tmp/config.json
+              '';
+              environment.WEBGHC_URL = "localhost:${toString port}";
+              serviceConfig = {
+                ExecSearchPath = "${flakePkgs.marlowe-playground-server}/bin";
+                DynamicUser = true;
+                LoadCredential = [
+                  "ghcs:${playground.github-client-secret-file}"
+                  "jwt:${playground.jwt-signature-file}"
+                ];
+                ExecStart = "marlowe-playground-server --config /tmp/config.json webserver --port ${toString port}";
+              };
+            };
+          };
+        })
+      cfg;
+  };
+}

From 2d5fae70529755aae150bffbde56d1f57174987b Mon Sep 17 00:00:00 2001
From: Shea Levy <shea@shealevy.com>
Date: Tue, 30 Apr 2024 16:50:57 -0400
Subject: [PATCH 2/3] deploy: Namespace http-services

---
 nix/nixos.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nix/nixos.nix b/nix/nixos.nix
index 7eeb7e1c5..0d4bb0467 100644
--- a/nix/nixos.nix
+++ b/nix/nixos.nix
@@ -46,7 +46,7 @@ in
   config = {
     http-services.static-sites = mapAttrs'
       (name: playground: {
-        name = "${name}-frontend";
+        name = "marlowe-playground-${name}-frontend";
         value = {
           inherit (playground) domain;
           root = "${playground.flake.packages.x86_64-linux.marlowe-playground-client}/share/marlowe-playground-client/static";
@@ -61,7 +61,7 @@ in
           flakePkgs = playground.flake.packages.x86_64-linux;
         in
         {
-          name = "${name}-backend";
+          name = "marlowe-playground-${name}-backend";
           value = {
             inherit (playground) domain;
             prefix = "/api";

From 4874b5356f9aa5dcea7f1cb7ddad506969125ef3 Mon Sep 17 00:00:00 2001
From: Shea Levy <shea@shealevy.com>
Date: Wed, 1 May 2024 10:01:47 -0400
Subject: [PATCH 3/3] NixOS: Fix oauth callback invocation

---
 nix/nixos.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix/nixos.nix b/nix/nixos.nix
index 0d4bb0467..d1db72a55 100644
--- a/nix/nixos.nix
+++ b/nix/nixos.nix
@@ -76,7 +76,7 @@ in
                   --rawfile ghClientSecret $CREDENTIALS_DIRECTORY/ghcs \
                   --rawfile jwt $CREDENTIALS_DIRECTORY/jwt \
                   --arg ghClientId ${lib.escapeShellArg playground.github-client-id} \
-                  --arg frontendUrl ${lib.escapeShellArg playground.domain} \
+                  --arg frontendUrl ${lib.escapeShellArg "https://${playground.domain}"} \
                   '{ "github-client-id": $ghClientId
                    , "github-client-secret": $ghClientSecret
                    , "jwt-signature": $jwt