wow

hosts/server/hikari/hako/configuration.nix

@@ -1,4 +1,34 @@
-{ pkgs, inputs, ... }:
+{ lib, pkgs, inputs, ... }:
+let
+  concordSession = pkgs.writeShellScriptBin "concord-session" ''
+    set -eu
+
+    runtime_dir="''${XDG_RUNTIME_DIR:-/tmp}"
+    session_dir="$(mktemp -d "$runtime_dir/concord-session.XXXXXX")"
+
+    cleanup() {
+      rm -rf -- "$session_dir"
+    }
+
+    trap cleanup EXIT
+    trap 'exit 129' HUP
+    trap 'exit 130' INT
+    trap 'exit 143' TERM
+
+    config_home="$session_dir/config"
+    state_home="$session_dir/state"
+    mkdir -p "$config_home" "$state_home"
+
+    cat > "$config_home/config.toml" <<'EOF'
+[credentials]
+store = "plain"
+EOF
+
+    XDG_CONFIG_HOME="$config_home" \
+      XDG_STATE_HOME="$state_home" \
+      "${inputs.concord.packages.${pkgs.system}.default}/bin/concord" "$@"
+  '';
+in
 {
   imports = [
     ./hardware-configuration.nix
@@ -29,6 +59,24 @@
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@kazusa"
   ];
 
+  users.users.discord = {
+    isNormalUser = true;
+    description = "Ephemeral Concord session user";
+    shell = pkgs.bashInteractive;
+    password = "";
+  };
+
+  services.openssh.extraConfig = ''
+    Match User discord
+      AuthenticationMethods none
+      PasswordAuthentication yes
+      PermitEmptyPasswords yes
+      ForceCommand ${concordSession}/bin/concord-session
+      DisableForwarding yes
+      PermitTTY yes
+      PermitUserRC no
+  '';
+
   environment.systemPackages = with pkgs; [
     eza
     neovim
@@ -44,6 +92,19 @@
 
   networking.firewall.enable = false;
 
+  # Keep short-lived service memory spikes from turning into a global OOM.
+  # The host has 8 GiB RAM and currently had no swap configured.
+  swapDevices = [
+    {
+      # nixpkgs currently requires a label definition for swap submodules,
+      # but file-backed swap must still use its real path here.
+      label = "hako-swap";
+      device = lib.mkForce "/swapfile";
+    }
+  ];
+
+  boot.kernel.sysctl."vm.swappiness" = 10;
+
   # /dev/sdd1 (ext4, UUID efdf753d-282c-4b78-9549-a124b353c6a5)
   fileSystems."/mnt/static" = {
     device = "/dev/disk/by-uuid/efdf753d-282c-4b78-9549-a124b353c6a5";