From 68d2af6dc47c95fb187536fe33f935667599be32 Mon Sep 17 00:00:00 2001
From: imnyang <imnyang@pm.me>
Date: Tue, 22 Sep 2026 22:54:41 +0900
Subject: [PATCH] wow

---
 hosts/server/natsu/services/caddy.nix         |  4 +
 .../natsu/services/cfwithoutincident.nix      | 81 ++++++++++++++++---
 modules/mizukios/features/caddy/common.nix    |  5 +-
 3 files changed, 79 insertions(+), 11 deletions(-)

diff --git a/hosts/server/natsu/services/caddy.nix b/hosts/server/natsu/services/caddy.nix
index f49e73f..956849b 100644
--- a/hosts/server/natsu/services/caddy.nix
+++ b/hosts/server/natsu/services/caddy.nix
@@ -33,6 +33,10 @@
       reverse_proxy localhost:9794
     '';
 
+    virtualHosts."wiki.icetang.xyz".extraConfig = ''
+      reverse_proxy localhost:51337
+    '';
+
     virtualHosts."pve.hikari.icn.mizuki.guru".extraConfig = ''
       reverse_proxy https://10.11.8.100:8006 {
                header_up X-Real-Ip {remote_host}
diff --git a/hosts/server/natsu/services/cfwithoutincident.nix b/hosts/server/natsu/services/cfwithoutincident.nix
index 2602946..ddf322e 100644
--- a/hosts/server/natsu/services/cfwithoutincident.nix
+++ b/hosts/server/natsu/services/cfwithoutincident.nix
@@ -1,5 +1,75 @@
 { inputs, pkgs, ... }:
 
+let
+  nodeModules = pkgs.stdenvNoCC.mkDerivation {
+    pname = "cfwithoutincident-node-modules";
+    version = "1.0.50";
+    src = inputs.cfwithoutincident;
+
+    nativeBuildInputs = [ pkgs.bun ];
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      export HOME="$TMPDIR/home"
+      export BUN_INSTALL_CACHE_DIR="$TMPDIR/bun-cache"
+      mkdir -p "$HOME" "$BUN_INSTALL_CACHE_DIR"
+
+      bun install \
+        --frozen-lockfile \
+        --ignore-scripts \
+        --no-progress \
+        --production
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p "$out"
+      cp -R node_modules "$out/"
+
+      runHook postInstall
+    '';
+
+    # Bun dependencies are fetched in this fixed-output derivation, so the
+    # regular build remains network-independent and reproducible.
+    dontFixup = true;
+    outputHash = "sha256-FrYyXCpzunrA92NQ9ffrmjJaPTFiTlCsW8OXdpt4m28=";
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+  };
+
+  cfwithoutincident = pkgs.stdenvNoCC.mkDerivation {
+    pname = "cfwithoutincident";
+    version = "1.0.50";
+    src = inputs.cfwithoutincident;
+
+    nativeBuildInputs = [ pkgs.bun ];
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      cp -R ${nodeModules}/node_modules .
+      bun build --compile --minify src/index.ts --outfile cfwithoutincident
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      install -Dm755 cfwithoutincident "$out/bin/cfwithoutincident"
+
+      runHook postInstall
+    '';
+
+    dontFixup = true;
+  };
+in
 {
   systemd.services.cfwithoutincident = {
     description = "Cloudflare Status D-Day dashboard";
@@ -11,21 +81,12 @@
       Type = "simple";
       User = "imnyang";
       Group = "users";
-      WorkingDirectory = "/var/lib/cfwithoutincident";
       Environment = [
         "PORT=31774"
       ];
-      ExecStartPre = [
-        "${pkgs.coreutils}/bin/cp -r ${inputs.cfwithoutincident}/. /var/lib/cfwithoutincident/"
-        "${pkgs.bun}/bin/bun install --frozen-lockfile"
-      ];
-      ExecStart = "${pkgs.bun}/bin/bun run src/index.ts";
+      ExecStart = "${cfwithoutincident}/bin/cfwithoutincident";
       Restart = "always";
       RestartSec = 5;
-      StateDirectory = "cfwithoutincident";
-      StateDirectoryMode = "0755";
     };
-
-    path = [ pkgs.bun ];
   };
 }
diff --git a/modules/mizukios/features/caddy/common.nix b/modules/mizukios/features/caddy/common.nix
index 199d9ab..e55eb47 100644
--- a/modules/mizukios/features/caddy/common.nix
+++ b/modules/mizukios/features/caddy/common.nix
@@ -43,7 +43,10 @@ in
         "github.com/RussellLuo/caddy-ext/ratelimit@v0.3.0"
         "github.com/neodyme-labs/user_agent_parse@v0.0.1"
       ];
-      hash = "sha256-r4MgRk8HpKYx7f8FmA3PKgD/5ZNTIHpQvlE+zRbP0lw=";
+      hash = {
+        "x86_64-linux" = "sha256-r4MgRk8HpKYx7f8FmA3PKgD/5ZNTIHpQvlE+zRbP0lw=";
+        "aarch64-linux" = "sha256-AfCiPSLCrZeKRJV6CRE6ps96lyinbgxaVnEpwLXPHMk=";
+      }.${pkgs.stdenv.hostPlatform.system};
     };
     globalConfig = ''
       admin unix//run/caddy/admin.socket