1 files changed, 104 insertions, 0 deletions
diff --git a/Omni/Deploy/Deployer.nix b/Omni/Deploy/Deployer.nix
new file mode 100644
index 0000000..091b43b
--- /dev/null
+++ b/Omni/Deploy/Deployer.nix
@@ -0,0 +1,104 @@
+{
+  options,
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
+  cfg = config.services.biz-deployer;
+in {
+  options.services.biz-deployer = {
+    enable = lib.mkEnableOption "Enable the biz-deployer mini-PaaS service";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      description = "The biz-deployer package to use";
+    };
+
+    manifestPackage = lib.mkOption {
+      type = lib.types.package;
+      description = "The deploy-manifest package for CLI operations";
+    };
+
+    interval = lib.mkOption {
+      type = lib.types.int;
+      default = 300;
+      description = "Interval in seconds between reconciliation cycles";
+    };
+
+    stateDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/biz-deployer";
+      description = "Directory for deployer state and generated unit files";
+    };
+
+    secretsDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/biz-secrets";
+      description = "Directory containing service secret .env files";
+    };
+
+    gcrootsDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/nix/var/nix/gcroots/biz";
+      description = "Directory for GC roots to prevent closure garbage collection";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Create required directories
+    systemd.tmpfiles.rules = [
+      "d ${cfg.stateDir} 0755 root root -"
+      "d ${cfg.stateDir}/services 0755 root root -"
+      "d ${cfg.secretsDir} 0700 root root -"
+      "d ${cfg.gcrootsDir} 0755 root root -"
+    ];
+
+    # The deployer service runs as a timer-triggered oneshot
+    systemd.services.biz-deployer = {
+      description = "Mini-PaaS deployment agent";
+      after = ["network-online.target"];
+      wants = ["network-online.target"];
+      path = [cfg.package cfg.manifestPackage pkgs.nix pkgs.awscli2];
+
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${cfg.package}/bin/biz-deployer once";
+        Environment = [
+          "HOME=/root"
+          "AWS_SHARED_CREDENTIALS_FILE=/root/.aws/credentials"
+        ];
+
+        # Note: Hardening disabled because deployer needs write access to
+        # /etc/systemd/system, /nix/store, /nix/var, /root/.cache/nix
+        PrivateTmp = true;
+      };
+    };
+
+    # Timer to run deployer every N seconds
+    systemd.timers.biz-deployer = {
+      description = "Timer for biz-deployer reconciliation";
+      wantedBy = ["timers.target"];
+      timerConfig = {
+        OnBootSec = "1min";
+        OnUnitActiveSec = "${toString cfg.interval}s";
+        Unit = "biz-deployer.service";
+      };
+    };
+
+    # Caddy reverse proxy for deployed services
+    # TODO: Generate this dynamically from manifest in the future
+    services.caddy = {
+      enable = true;
+      globalConfig = ''
+        admin localhost:2019
+      '';
+      virtualHosts."podcastitlater.bensima.com".extraConfig = ''
+        reverse_proxy localhost:8000
+      '';
+    };
+
+    # Open firewall for HTTP/HTTPS
+    networking.firewall.allowedTCPPorts = [80 443];
+  };
+}