feat(caddy): add novnc

machines/bomba/services/caddy.nix

@@ -1,12 +1,37 @@
-{ config, ... }:
 {
-  services.caddy = {
+  pkgs,
+  config,
+  currentSystemUser,
+  ...
+}:
+{
+  services.caddy =
+    let
+      basicAuth = ''
+        basicauth {
+          ${currentSystemUser} $2a$14$L6SBwu.0FhGBYwH2LWa6uOrBSeRHo8Lo95Vkle/g5uB7kZl7nmJPO
+        }
+      '';
+    in
+    {
       enable = true;
       virtualHosts = {
         "patrickcanal.it".extraConfig = ''
           root /var/www/patrickcanal.it/public
           file_server
         '';
+        "novnc.patrickcanal.it".extraConfig = ''
+          handle {
+            ${basicAuth}
+            root ${pkgs.novnc}/share/webapps/novnc
+            file_server browse
+          }
+
+          handle /websockify {
+            ${basicAuth}
+            reverse_proxy 127.0.0.1:6080
+          }
+        '';
         "vaultwarden.patrickcanal.it".extraConfig = ''
           encode zstd gzip
           reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT} {
@@ -45,4 +70,19 @@
         '';
       };
     };
+
+  systemd.services.websockify = {
+    description = "Websockify for noVNC";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Restart = "always";
+      User = "nobody";
+      ExecStart = ''
+        ${pkgs.python3Packages.websockify}/bin/websockify \
+          --web ${pkgs.novnc}/share/webapps/novnc \
+          6080 127.0.0.1:5900
+      '';
+    };
+  };
 }