fix(bomba): move websockify service from user to dynamic user

flake.lock

@@ -113,11 +113,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779507042,
-        "narHash": "sha256-7wOwi8B6D0BYsieZCnHZZj2sNUzgJhLoIVSfkwB7lxQ=",
+        "lastModified": 1779627636,
+        "narHash": "sha256-J6JGf42zNzLo/CrRdKb5dNznpLI+eGxN/5KTLG1Mo5s=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "509ed3c603349a9d43de9e2ae6613baea6bd5b34",
+        "rev": "044c30c19550c0557997dece4ce9e54d2fa77ba1",
         "type": "github"
       },
       "original": {
@@ -206,11 +206,11 @@
     },
     "nixpkgs-25-11": {
       "locked": {
-        "lastModified": 1779102034,
-        "narHash": "sha256-vZJZjLo513IeI8hjzHFc6TDezUd4uCE2Eq4SNO3DNNg=",
+        "lastModified": 1779467186,
+        "narHash": "sha256-nOesoDCiXcUftqbRBMz9tt4blI5PvljMWbm3kuCA+0s=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "687f05a9184cad4eaf905c48b63649e3a86f5433",
+        "rev": "b77b3de8775677f84492abe84635f87b0e153f0f",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1779357205,
-        "narHash": "sha256-cCO8aTqss5x9Ky8GWkpY0Hy5fyTZEbtifSUV8QjSzic=",
+        "lastModified": 1779508470,
+        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f83fc3c307e74bc5fd5adb7eb6b8b13ffd2a36e1",
+        "rev": "29916453413845e54a65b8a1cf996842300cd299",
         "type": "github"
       },
       "original": {
@@ -329,11 +329,11 @@
         "noctalia-qs": "noctalia-qs"
       },
       "locked": {
-        "lastModified": 1779504029,
-        "narHash": "sha256-f8u9DV9Qk8KJh7DVvk4UgUFTN0NDJeFxgrffTSwPkpA=",
+        "lastModified": 1779591140,
+        "narHash": "sha256-G54zkslNueiiYDtg8QbAkPTv0/vfLzdjDsaUljlRQAE=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "b99b7a7f06ff749df9ac43181ff7889ff90c5599",
+        "rev": "052f533186e6ad8e60541760cfe3123f14108c1e",
         "type": "github"
       },
       "original": {
@@ -352,11 +352,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1778983195,
-        "narHash": "sha256-hE3EFK5GoSdbO5WHZ8bZDUVYkofbDLQN/KK25z7IOOI=",
+        "lastModified": 1779588472,
+        "narHash": "sha256-CVonDVo41DqdqS/kNeXFatwEuTltyXcppm9zkVOnrsM=",
         "owner": "noctalia-dev",
         "repo": "noctalia-qs",
-        "rev": "4116b41cdc89e186be7cb8b24a9b6022af95d742",
+        "rev": "70fea8a39a908e395de63024a4dfdb829bff1ffe",
         "type": "github"
       },
       "original": {

machines/bomba/services/caddy.nix

@@ -1,43 +1,87 @@
-{ config, ... }:
 {
-  services.caddy = {
-    enable = true;
-    virtualHosts = {
-      "vaultwarden.patrickcanal.it".extraConfig = ''
+  pkgs,
+  config,
+  currentSystemUser,
+  ...
+}:
+{
+  services.caddy =
+    let
+      basicAuth = ''
+        basicauth {
+          ${currentSystemUser} $2a$14$L6SBwu.0FhGBYwH2LWa6uOrBSeRHo8Lo95Vkle/g5uB7kZl7nmJPO
+        }
+      '';
+    in
+    {
+      enable = true;
+      virtualHosts = {
+        "patrickcanal.it".extraConfig = ''
+          root /var/www/patrickcanal.it/public
+          file_server
+        '';
+        "novnc.patrickcanal.it".extraConfig = ''
+          handle {
+            ${basicAuth}
+            root ${pkgs.novnc}/share/webapps/novnc
+            file_server browse
+          }
+
+          handle /websockify {
+            ${basicAuth}
+            reverse_proxy 127.0.0.1:6080
+          }
+        '';
+        "vaultwarden.patrickcanal.it".extraConfig = ''
           encode zstd gzip
           reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT} {
             header_up X-Real-IP {remote_host}
           }
-      '';
-      "gitea.patrickcanal.it".extraConfig = ''
+        '';
+        "gitea.patrickcanal.it".extraConfig = ''
           reverse_proxy :${toString config.services.gitea.settings.server.HTTP_PORT}
-      '';
-      "nextcloud.patrickcanal.it".extraConfig = ''
+        '';
+        "nextcloud.patrickcanal.it".extraConfig = ''
           reverse_proxy :8004
-      '';
-      "octoprint.patrickcanal.it".extraConfig = ''
-        reverse_proxy :${toString config.services.octoprint.port}
-      ''; 
-      "vikunja.patrickcanal.it".extraConfig = ''
-        reverse_proxy :${toString config.services.vikunja.port}
-      ''; 
-      "jellyfin.patrickcanal.it".extraConfig = ''
-        reverse_proxy :${toString config.nixflix.jellyfin.network.internalHttpPort}
-      '';
-      "qbittorrent.patrickcanal.it".extraConfig = ''
-        reverse_proxy :${toString config.nixflix.downloadarr.qbittorrent.port}
-      '';
-      "radarr.patrickcanal.it".extraConfig = ''
-        reverse_proxy :${toString config.nixflix.radarr.settings.server.port}
-      '';
-      "sonarr.patrickcanal.it".extraConfig = ''
-        reverse_proxy :${toString config.nixflix.sonarr.settings.server.port}
-      '';
-      "prowlarr.patrickcanal.it".extraConfig = ''
-        reverse_proxy :${toString config.nixflix.prowlarr.settings.server.port}
-      '';
-      "seerr.patrickcanal.it".extraConfig = ''
-        reverse_proxy :${toString config.nixflix.seerr.port}
+        '';
+        "octoprint.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.services.octoprint.port}
+        '';
+        "vikunja.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.services.vikunja.port}
+        '';
+        "jellyfin.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.jellyfin.network.internalHttpPort}
+        '';
+        "qbittorrent.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.downloadarr.qbittorrent.port}
+        '';
+        "radarr.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.radarr.settings.server.port}
+        '';
+        "sonarr.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.sonarr.settings.server.port}
+        '';
+        "prowlarr.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.prowlarr.settings.server.port}
+        '';
+        "seerr.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.nixflix.seerr.port}
+        '';
+      };
+    };
+
+  systemd.services.websockify = {
+    description = "Websockify for noVNC";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Restart = "always";
+      DynamicUser = true;
+      ExecStart = ''
+        ${pkgs.python3Packages.websockify}/bin/websockify \
+          --web ${pkgs.novnc}/share/webapps/novnc \
+          6080 127.0.0.1:5900
       '';
     };
   };

modules/packages.nix

@@ -86,6 +86,7 @@
         piper
         qbittorrent
         seahorse
+        spotiflac
         telegram-desktop
         thunderbird
         vlc