Merge pull request #29 from archtika/devel

Refactoring and small improvements

.github/workflows/test.yml

@@ -23,7 +23,7 @@ jobs:
       run: |
         wait_for_postgres() {
           echo "Waiting for PostgreSQL to be ready..."
-          while ! nix shell nixpkgs#postgresql_16 -c pg_isready -h 127.0.0.1 -p 15432 -U postgres; do
+          while ! nix shell nixpkgs#postgresql -c pg_isready -h 127.0.0.1 -p 15432 -U postgres; do
             sleep 1
           done
           echo "PostgreSQL is ready."

flake.nix

@@ -36,7 +36,7 @@
             '';
           };
           web = pkgs.mkShell {
-            packages = with pkgs; [ nodejs_22 ];
+            packages = with pkgs; [ nodejs ];
             shellHook = ''
               export PLAYWRIGHT_BROWSERS_PATH=${pkgs.playwright-driver.browsers}
               export PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS=true

nix/deploy/prod/default.nix

@@ -1,6 +1,8 @@
 { pkgs, localArchtikaPackage, ... }:
 let
   domain = "demo.archtika.com";
+  docsSubdomain = "docs.archtika.com";
+  portfolioDomain = "thilohohlt.com";
 in
 {
   imports = [
@@ -25,10 +27,37 @@ in
     defaults.email = "thilo.hohlt@tutanota.com";
     certs."${domain}" = {
       inherit domain;
-      extraDomainNames = [ "*.${domain}" ];
+      extraDomainNames = [
+        "*.${domain}"
+        docsSubdomain
+      ];
       dnsProvider = "porkbun";
       environmentFile = /var/lib/porkbun.env;
       group = "nginx";
     };
   };
+
+  services.nginx.virtualHosts."${docsSubdomain}" = {
+    useACMEHost = domain;
+    forceSSL = true;
+    locations = {
+      "/" = {
+        root = "/var/www/archtika-websites/archtika/archtika-documentation";
+        index = "index.html";
+        tryFiles = "$uri $uri/ $uri.html =404";
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."${portfolioDomain}" = {
+    enableACME = true;
+    forceSSL = true;
+    locations = {
+      "/" = {
+        root = "/var/www/archtika-websites/thiloho/thilo-hohlt";
+        index = "index.html";
+        tryFiles = "$uri $uri/ $uri.html =404";
+      };
+    };
+  };
 }

nix/module.nix

@@ -69,7 +69,7 @@ in
           disableRegistration = mkOption {
             type = types.bool;
             default = false;
-            description = "By default any user can create an account. That behavior can be disabled by using this option.";
+            description = "By default any user can create an account. That behavior can be disabled with this option.";
           };
           maxUserWebsites = mkOption {
             type = types.ints.positive;
@@ -128,8 +128,7 @@ in
         ];
       };
 
-      systemd.tmpfiles.settings = {
+      systemd.tmpfiles.settings."10-archtika" = {
-        "10-archtika" = {
         "/var/www" = {
           d = {
             mode = "0755";
@@ -145,7 +144,6 @@ in
           };
         };
       };
-      };
 
       systemd.services.archtika-api = {
         description = "archtika API service";
@@ -171,9 +169,7 @@ in
 
         script =
           let
-            dbUrl =
+            dbUrl = user: "postgres://${user}@/${cfg.databaseName}?host=/var/run/postgresql";
-              user:
-              "postgres://${user}@127.0.0.1:${toString config.services.postgresql.settings.port}/${cfg.databaseName}";
           in
           ''
             JWT_SECRET=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c64)
@@ -183,7 +179,7 @@ in
               -c "ALTER DATABASE ${cfg.databaseName} SET \"app.website_max_storage_size\" TO ${toString cfg.settings.maxWebsiteStorageSize}" \
               -c "ALTER DATABASE ${cfg.databaseName} SET \"app.website_max_number_user\" TO ${toString cfg.settings.maxUserWebsites}"
 
-            ${pkgs.dbmate}/bin/dbmate --url ${dbUrl "postgres"}?sslmode=disable --migrations-dir ${cfg.package}/rest-api/db/migrations up
+            ${lib.getExe pkgs.dbmate} --url "${dbUrl "postgres"}&sslmode=disable" --migrations-dir ${cfg.package}/rest-api/db/migrations up
 
             PGRST_SERVER_CORS_ALLOWED_ORIGINS="https://${cfg.domain}" \
             PGRST_ADMIN_SERVER_PORT=${toString cfg.apiAdminPort} \
@@ -193,7 +189,7 @@ in
             PGRST_OPENAPI_MODE="ignore-privileges" \
             PGRST_DB_URI=${dbUrl "authenticator"} \
             PGRST_JWT_SECRET="$JWT_SECRET" \
-            ${pkgs.postgrest}/bin/postgrest
+            ${lib.getExe pkgs.postgrest}
           '';
       };
 
@@ -220,24 +216,23 @@ in
           PORT = toString cfg.webAppPort;
         };
 
-        script = "${pkgs.nodejs_22}/bin/node ${cfg.package}/web-app";
+        script = "${lib.getExe pkgs.nodejs} ${cfg.package}/web-app";
       };
 
       services.postgresql = {
         enable = true;
         ensureDatabases = [ cfg.databaseName ];
-        authentication = lib.mkOverride 51 ''
+        extensions = ps: with ps; [ pgjwt ];
-          host    all    all    127.0.0.1/32    trust
+        authentication = lib.mkOverride 11 ''
-          host    all    all    ::1/128         trust
           local all all trust
         '';
-        extensions = ps: with ps; [ pgjwt ];
       };
 
       systemd.services.postgresql = {
-        path = builtins.attrValues {
+        path = with pkgs; [
-          inherit (pkgs) gnutar gzip;
+          gnutar
-        };
+          gzip
+        ];
         serviceConfig = {
           ReadWritePaths = [ "/var/www/archtika-websites" ];
           SystemCallFilter = [ "@system-service" ];
@@ -252,13 +247,7 @@ in
         recommendedOptimisation = true;
 
         appendHttpConfig = ''
-          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+          map $http_cookie $archtika_auth_header {
-          add_header X-Frame-Options "SAMEORIGIN" always;
-          add_header X-Content-Type-Options "nosniff" always;
-          add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-          add_header Permissions-Policy "accelerometer=(),autoplay=(),camera=(),cross-origin-isolated=(),display-capture=(),encrypted-media=(),fullscreen=(self),geolocation=(),gyroscope=(),keyboard-map=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(self),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),xr-spatial-tracking=(),clipboard-read=(self),clipboard-write=(self),gamepad=(),hid=(),idle-detection=(),interest-cohort=(),serial=(),unload=()" always;
-
-          map $http_cookie $auth_header {
             default "";
             "~*session_token=([^;]+)" "Bearer $1";
           }
@@ -281,7 +270,7 @@ in
                 proxyPass = "http://127.0.0.1:${toString cfg.apiPort}/rpc/export_articles_zip";
                 extraConfig = ''
                   default_type application/json;
-                  proxy_set_header Authorization $auth_header;
+                  proxy_set_header Authorization $archtika_auth_header;
                 '';
               };
               "/api/" = {

web-app/src/lib/components/WebsiteEditor.svelte

@@ -3,6 +3,7 @@
   import { md } from "$lib/utils";
   import { page } from "$app/stores";
   import { previewContent, textareaScrollTop } from "$lib/runes.svelte";
+  import { browser } from "$app/environment";
 
   const {
     id,
@@ -57,14 +58,14 @@
 
 <div class="preview" bind:this={previewElement}>
   {#if fullPreview}
-    {#if !iframeLoaded}
+    {#if !iframeLoaded && browser}
       <p>Loading preview...</p>
     {/if}
     <iframe
       src={previewContent.value}
       title="Preview"
       onload={() => (iframeLoaded = true)}
-      style:display={iframeLoaded ? "block" : "none"}
+      style:display={!browser || iframeLoaded ? "block" : "none"}
     ></iframe>
   {:else}
     {@html md(
@@ -131,6 +132,9 @@
 
     .operations {
       padding-block-start: var(--space-s);
+      resize: horizontal;
+      min-inline-size: 100%;
+      max-inline-size: calc(1536px - 320px);
     }
 
     .preview {

website/index.html

@@ -17,7 +17,7 @@
     <p class="mt-2 text-xl text-neutral-700 sm:text-2xl">FLOSS, modern, performant, lightweight and self&#8209;hosted CMS</p>
     <div class="mt-8 flex flex-wrap gap-6 sm:justify-end">
       <a href="https://github.com/archtika/archtika" class="text-neutral-900 rounded-full bg-neutral-200 px-4 py-2 outline outline-1 outline-offset-4 outline-neutral-300 hover:bg-neutral-300 hover:underline focus:outline-2 focus:outline-neutral-900">GitHub</a>
-      <a href="https://archtika.demo.archtika.com/archtika-documentation" class="text-neutral-900 rounded-full bg-neutral-200 px-4 py-2 outline outline-1 outline-offset-4 outline-neutral-300 hover:bg-neutral-300 hover:underline focus:outline-2 focus:outline-neutral-900">Documentation</a>
+      <a href="https://docs.archtika.com" class="text-neutral-900 rounded-full bg-neutral-200 px-4 py-2 outline outline-1 outline-offset-4 outline-neutral-300 hover:bg-neutral-300 hover:underline focus:outline-2 focus:outline-neutral-900">Documentation</a>
     </div>
   </div>
 </body>