feat(access): minecraft

nixos/access/gensokyo.nix

@@ -5,9 +5,11 @@
   pkgs,
   ...
 }: let
-  inherit (lib.modules) mkMerge mkAfter;
+  inherit (lib.modules) mkMerge mkAfter mkDefault;
   inherit (lib.strings) escapeRegex;
   inherit (gensokyo-zone.lib) domain;
+  inherit (config.services) nginx;
+  minecraftBackups = "${config.kyuuto.dataDir}/minecraft/simplebackups";
 in {
   services.nginx.virtualHosts.gensokyoZone = {
     serverName = domain;
@@ -23,6 +25,20 @@ in {
           }
         ];
       };
+      "/minecraft/backups" = {
+        root = pkgs.linkFarm "genso-minecraft-backups" [
+          {
+            name = "minecraft/backups";
+            path = minecraftBackups;
+          }
+        ];
+        extraConfig = ''
+          gzip off;
+          autoindex on;
+          auth_basic "private";
+          auth_basic_user_file ${config.sops.secrets.access-web-htpasswd.path};
+        '';
+      };
       "/.well-known/webfinger" = let
         # https://www.rfc-editor.org/rfc/rfc7033#section-3.1
         oidc = {
@@ -57,4 +73,11 @@ in {
       };
     };
   };
+  systemd.services.nginx.serviceConfig.BindReadOnlyPaths = [
+    minecraftBackups
+  ];
+  sops.secrets.access-web-htpasswd = {
+    sopsFile = mkDefault ../secrets/access.yaml;
+    owner = nginx.user;
+  };
 }