This repository has no description
2configs/silverbullet: add wiki, public read + pocket-id SSO write
author
lassulus
date
(Jul 25, 2026, 11:28 PM CEST)
commit
8aae1e3d
8aae1e3d4201e09f04a27c594a82af172e058ef6
parent
f9631600
f9631600bc185b5ac1e4d6a365fe4638ff40c6a5
+84
+80
2configs/silverbullet.nix
+80
2configs/silverbullet.nix
···
1
+
{
2
+
config,
3
+
lib,
4
+
...
5
+
}:
6
+
let
7
+
publicDomain = "wiki.lassul.us";
8
+
adminDomain = "wiki-rw.lassul.us";
9
+
spaceDir = "/var/lib/silverbullet";
10
+
publicPort = 3000;
11
+
adminPort = 3001;
12
+
user = "silverbullet";
13
+
group = "silverbullet";
14
+
in
15
+
{
16
+
# SilverBullet auth is all-or-nothing per instance and has no OIDC client, so
17
+
# we run two instances over the same space:
18
+
# - public (wiki.lassul.us): anonymous, SB_READ_ONLY
19
+
# - admin (wiki-rw.lassul.us): read-write, no built-in auth; gated by the
20
+
# shared oauth2-proxy -> pocket-id SSO
21
+
# (see 2configs/oauth2-proxy.nix).
22
+
23
+
# --- Public, anonymous, read-only instance (nixpkgs module) -------------
24
+
services.silverbullet = {
25
+
enable = true;
26
+
inherit user group;
27
+
listenAddress = "127.0.0.1";
28
+
listenPort = publicPort;
29
+
spaceDir = spaceDir;
30
+
};
31
+
systemd.services.silverbullet.environment = {
32
+
SB_READ_ONLY = "1";
33
+
SB_SHELL_BACKEND = "off";
34
+
};
35
+
36
+
# --- Admin, read-write instance (no built-in auth; SSO in front) --------
37
+
systemd.services.silverbullet-admin = {
38
+
description = "SilverBullet (admin, read-write)";
39
+
after = [ "network.target" ];
40
+
wantedBy = [ "multi-user.target" ];
41
+
environment = {
42
+
SB_SHELL_BACKEND = "off";
43
+
# Forward-auth (oauth2-proxy) and SilverBullet's PWA service worker fight
44
+
# over redirects/caching; disabling the service worker sends every request
45
+
# straight to the server so auth behaves predictably.
46
+
SB_DISABLE_SERVICE_WORKER = "1";
47
+
};
48
+
serviceConfig = {
49
+
Type = "simple";
50
+
User = user;
51
+
Group = group;
52
+
StateDirectory = "silverbullet";
53
+
ExecStart = "${lib.getExe config.services.silverbullet.package} --port ${toString adminPort} --hostname 127.0.0.1 '${spaceDir}'";
54
+
Restart = "on-failure";
55
+
};
56
+
};
57
+
58
+
# Gate the read-write instance behind the shared pocket-id SSO layer.
59
+
services.oauth2-proxy.nginx.virtualHosts.${adminDomain} = { };
60
+
61
+
# --- nginx vhosts -------------------------------------------------------
62
+
services.nginx.virtualHosts.${publicDomain} = {
63
+
enableACME = true;
64
+
forceSSL = true;
65
+
locations."/" = {
66
+
proxyPass = "http://127.0.0.1:${toString publicPort}";
67
+
proxyWebsockets = true;
68
+
};
69
+
};
70
+
# The oauth2-proxy nginx module merges auth_request + /oauth2/ endpoints into
71
+
# this vhost; we only add ACME/TLS and the backend proxy to the admin app.
72
+
services.nginx.virtualHosts.${adminDomain} = {
73
+
enableACME = true;
74
+
forceSSL = true;
75
+
locations."/" = {
76
+
proxyPass = "http://127.0.0.1:${toString adminPort}";
77
+
proxyWebsockets = true;
78
+
};
79
+
};
80
+
}
+2
2configs/dns/lassul.us.zone
+2
2configs/dns/lassul.us.zone
+2
machines/neoprism/config.nix
+2
machines/neoprism/config.nix
···
103
103
../../2configs/pocket-id.nix
104
104
# shared oauth2-proxy forward-auth against pocket-id (auth.lassul.us)
105
105
../../2configs/oauth2-proxy.nix
106
+
# silverbullet wiki: wiki.lassul.us (public read) + wiki-rw.lassul.us (SSO write)
107
+
../../2configs/silverbullet.nix
106
108
];
107
109
108
110
# lassul.us shouldn't be the default vhost here (nginx.nix already sets one)