Merge pull request #29 from archtika/devel

Refactoring and small improvements

.github/workflows/test.yml

@@ -23,7 +23,7 @@ jobs:
       run: |
         wait_for_postgres() {
           echo "Waiting for PostgreSQL to be ready..."
-          while ! nix shell nixpkgs#postgresql_16 -c pg_isready -h 127.0.0.1 -p 15432 -U postgres; do
+          while ! nix shell nixpkgs#postgresql -c pg_isready -h 127.0.0.1 -p 15432 -U postgres; do
             sleep 1
           done
           echo "PostgreSQL is ready."

flake.nix

@@ -36,7 +36,7 @@
             '';
           };
           web = pkgs.mkShell {
-            packages = with pkgs; [ nodejs_22 ];
+            packages = with pkgs; [ nodejs ];
             shellHook = ''
               export PLAYWRIGHT_BROWSERS_PATH=${pkgs.playwright-driver.browsers}
               export PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS=true

nix/deploy/prod/default.nix

@@ -27,7 +27,10 @@ in
     defaults.email = "thilo.hohlt@tutanota.com";
     certs."${domain}" = {
       inherit domain;
-      extraDomainNames = [ "*.${domain}" docsSubdomain ];
+      extraDomainNames = [
+        "*.${domain}"
+        docsSubdomain
+      ];
       dnsProvider = "porkbun";
       environmentFile = /var/lib/porkbun.env;
       group = "nginx";

nix/module.nix

@@ -69,7 +69,7 @@ in
           disableRegistration = mkOption {
             type = types.bool;
             default = false;
-            description = "By default any user can create an account. That behavior can be disabled by using this option.";
+            description = "By default any user can create an account. That behavior can be disabled with this option.";
           };
           maxUserWebsites = mkOption {
             type = types.ints.positive;
@@ -128,21 +128,19 @@ in
         ];
       };
 
-      systemd.tmpfiles.settings = {
+      systemd.tmpfiles.settings."10-archtika" = {
-        "10-archtika" = {
+        "/var/www" = {
-          "/var/www" = {
+          d = {
-            d = {
+            mode = "0755";
-              mode = "0755";
+            user = "root";
-              user = "root";
+            group = "root";
-              group = "root";
-            };
           };
-          "/var/www/archtika-websites" = {
+        };
-            d = {
+        "/var/www/archtika-websites" = {
-              mode = "0770";
+          d = {
-              user = cfg.user;
+            mode = "0770";
-              group = cfg.group;
+            user = cfg.user;
-            };
+            group = cfg.group;
           };
         };
       };
@@ -171,9 +169,7 @@ in
 
         script =
           let
-            dbUrl =
+            dbUrl = user: "postgres://${user}@/${cfg.databaseName}?host=/var/run/postgresql";
-              user:
-              "postgres://${user}@127.0.0.1:${toString config.services.postgresql.settings.port}/${cfg.databaseName}";
           in
           ''
             JWT_SECRET=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c64)
@@ -183,7 +179,7 @@ in
               -c "ALTER DATABASE ${cfg.databaseName} SET \"app.website_max_storage_size\" TO ${toString cfg.settings.maxWebsiteStorageSize}" \
               -c "ALTER DATABASE ${cfg.databaseName} SET \"app.website_max_number_user\" TO ${toString cfg.settings.maxUserWebsites}"
 
-            ${pkgs.dbmate}/bin/dbmate --url ${dbUrl "postgres"}?sslmode=disable --migrations-dir ${cfg.package}/rest-api/db/migrations up
+            ${lib.getExe pkgs.dbmate} --url "${dbUrl "postgres"}&sslmode=disable" --migrations-dir ${cfg.package}/rest-api/db/migrations up
 
             PGRST_SERVER_CORS_ALLOWED_ORIGINS="https://${cfg.domain}" \
             PGRST_ADMIN_SERVER_PORT=${toString cfg.apiAdminPort} \
@@ -193,7 +189,7 @@ in
             PGRST_OPENAPI_MODE="ignore-privileges" \
             PGRST_DB_URI=${dbUrl "authenticator"} \
             PGRST_JWT_SECRET="$JWT_SECRET" \
-            ${pkgs.postgrest}/bin/postgrest
+            ${lib.getExe pkgs.postgrest}
           '';
       };
 
@@ -220,24 +216,23 @@ in
           PORT = toString cfg.webAppPort;
         };
 
-        script = "${pkgs.nodejs_22}/bin/node ${cfg.package}/web-app";
+        script = "${lib.getExe pkgs.nodejs} ${cfg.package}/web-app";
       };
 
       services.postgresql = {
         enable = true;
         ensureDatabases = [ cfg.databaseName ];
-        authentication = lib.mkOverride 51 ''
-          host    all    all    127.0.0.1/32    trust
-          host    all    all    ::1/128         trust
-          local   all    all                    trust
-        '';
         extensions = ps: with ps; [ pgjwt ];
+        authentication = lib.mkOverride 11 ''
+          local all all trust
+        '';
       };
 
       systemd.services.postgresql = {
-        path = builtins.attrValues {
+        path = with pkgs; [
-          inherit (pkgs) gnutar gzip;
+          gnutar
-        };
+          gzip
+        ];
         serviceConfig = {
           ReadWritePaths = [ "/var/www/archtika-websites" ];
           SystemCallFilter = [ "@system-service" ];
@@ -252,13 +247,7 @@ in
         recommendedOptimisation = true;
 
         appendHttpConfig = ''
-          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+          map $http_cookie $archtika_auth_header {
-          add_header X-Frame-Options "SAMEORIGIN" always;
-          add_header X-Content-Type-Options "nosniff" always;
-          add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-          add_header Permissions-Policy "accelerometer=(),autoplay=(),camera=(),cross-origin-isolated=(),display-capture=(),encrypted-media=(),fullscreen=(self),geolocation=(),gyroscope=(),keyboard-map=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(self),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),xr-spatial-tracking=(),clipboard-read=(self),clipboard-write=(self),gamepad=(),hid=(),idle-detection=(),interest-cohort=(),serial=(),unload=()" always;
-
-          map $http_cookie $auth_header {
             default "";
             "~*session_token=([^;]+)" "Bearer $1";
           }
@@ -281,7 +270,7 @@ in
                 proxyPass = "http://127.0.0.1:${toString cfg.apiPort}/rpc/export_articles_zip";
                 extraConfig = ''
                   default_type application/json;
-                  proxy_set_header Authorization $auth_header;
+                  proxy_set_header Authorization $archtika_auth_header;
                 '';
               };
               "/api/" = {

web-app/src/lib/components/WebsiteEditor.svelte

@@ -3,6 +3,7 @@
   import { md } from "$lib/utils";
   import { page } from "$app/stores";
   import { previewContent, textareaScrollTop } from "$lib/runes.svelte";
+  import { browser } from "$app/environment";
 
   const {
     id,
@@ -57,14 +58,14 @@
 
 <div class="preview" bind:this={previewElement}>
   {#if fullPreview}
-    {#if !iframeLoaded}
+    {#if !iframeLoaded && browser}
       <p>Loading preview...</p>
     {/if}
     <iframe
       src={previewContent.value}
       title="Preview"
       onload={() => (iframeLoaded = true)}
-      style:display={iframeLoaded ? "block" : "none"}
+      style:display={!browser || iframeLoaded ? "block" : "none"}
     ></iframe>
   {:else}
     {@html md(
@@ -131,6 +132,9 @@
 
     .operations {
       padding-block-start: var(--space-s);
+      resize: horizontal;
+      min-inline-size: 100%;
+      max-inline-size: calc(1536px - 320px);
     }
 
     .preview {