This repository has no description
neoprism: host book on book.lassul.us
author
lassulus
date
(Oct 6, 2026, 12:32 PM CEST)
commit
110b46cf
110b46cfc523d2506f6f381ea5bcfe22a26390d9
parent
62c7cb69
62c7cb69a159a9897ddcbeba7e09d830d62e00bb
+116
+113
configs/book.nix
+113
configs/book.nix
···
1
+
let
2
+
domain = "book.lassul.us";
3
+
port = 8772;
4
+
in
5
+
{
6
+
config,
7
+
lib,
8
+
pkgs,
9
+
self,
10
+
...
11
+
}:
12
+
let
13
+
settings = {
14
+
listen = "127.0.0.1:${toString port}";
15
+
baseUrl = "https://${domain}";
16
+
owner = "lassulus";
17
+
intro = "Pick a time for a call: nix, nixos, infrastructure, or anything else.";
18
+
timezone = "Europe/Berlin";
19
+
eventTypes = [
20
+
{
21
+
slug = "30min";
22
+
title = "30 minute call";
23
+
minutes = 30;
24
+
}
25
+
{
26
+
slug = "60min";
27
+
title = "1 hour call";
28
+
minutes = 60;
29
+
}
30
+
];
31
+
hours = lib.genAttrs [ "mon" "tue" "wed" "thu" "fri" ] (_: [ "10:00-18:00" ]);
32
+
slotStep = 30;
33
+
bufferMinutes = 15;
34
+
minNoticeHours = 24;
35
+
horizonDays = 28;
36
+
# Free/busy is read from every calendar of this radicale user; requests
37
+
# and bookings are written to its `calendar` collection (created on demand).
38
+
caldav = {
39
+
url = "http://127.0.0.1:5232";
40
+
user = "lass";
41
+
calendar = "bookings";
42
+
};
43
+
# Local postfix (configs/mailserver.nix) accepts from localhost and DKIM-signs.
44
+
smtp = {
45
+
host = "127.0.0.1";
46
+
port = 25;
47
+
from = "book@lassul.us";
48
+
notify = "lass@lassul.us";
49
+
};
50
+
database = "/var/lib/book/book.db";
51
+
};
52
+
in
53
+
{
54
+
# book: request-and-approve booking page (tools/book). Requests land in
55
+
# radicale (configs/radicale.nix) as TENTATIVE events and in lass's inbox
56
+
# with an approve link.
57
+
systemd.services.book = {
58
+
description = "book.lassul.us booking page";
59
+
wantedBy = [ "multi-user.target" ];
60
+
wants = [ "radicale.service" ];
61
+
after = [
62
+
"network.target"
63
+
"radicale.service"
64
+
];
65
+
serviceConfig = {
66
+
ExecStart = lib.escapeShellArgs [
67
+
(lib.getExe self.packages.${pkgs.stdenv.hostPlatform.system}.book)
68
+
"--config"
69
+
(pkgs.writeText "book.json" (builtins.toJSON settings))
70
+
"--caldav-password-file"
71
+
"%d/caldav-password"
72
+
];
73
+
LoadCredential = "caldav-password:${
74
+
config.clan.core.vars.generators.radicale-lass.files."password".path
75
+
}";
76
+
DynamicUser = true;
77
+
StateDirectory = "book";
78
+
Restart = "on-failure";
79
+
CapabilityBoundingSet = "";
80
+
NoNewPrivileges = true;
81
+
PrivateDevices = true;
82
+
PrivateTmp = true;
83
+
ProtectHome = true;
84
+
ProtectSystem = "strict";
85
+
ProtectKernelTunables = true;
86
+
ProtectKernelModules = true;
87
+
ProtectControlGroups = true;
88
+
RestrictAddressFamilies = [
89
+
"AF_INET"
90
+
"AF_INET6"
91
+
"AF_UNIX"
92
+
];
93
+
RestrictNamespaces = true;
94
+
LockPersonality = true;
95
+
SystemCallArchitectures = "native";
96
+
};
97
+
};
98
+
99
+
services.nginx.virtualHosts.${domain} = {
100
+
enableACME = true;
101
+
forceSSL = true;
102
+
locations."/" = {
103
+
proxyPass = "http://127.0.0.1:${toString port}";
104
+
# book rate-limits per X-Real-IP; set it from the socket, never from
105
+
# a client-supplied header.
106
+
extraConfig = ''
107
+
proxy_set_header Host $host;
108
+
proxy_set_header X-Real-IP $remote_addr;
109
+
client_max_body_size 16k;
110
+
'';
111
+
};
112
+
};
113
+
}