From 791a3bdf3475e93264d0635995839613f5f2242b Mon Sep 17 00:00:00 2001
From: rope <fredrik@nordhammer.it>
Date: Sun, 18 Oct 2026 13:55:14 +0100
Subject: [PATCH] Add guildhall

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 common.nix             |  1 +
 flake.lock             | 21 +++++++++++++++++++++
 flake.nix              |  7 +++++++
 services/authelia.nix  |  1 +
 services/guildhall.nix | 16 ++++++++++++++++
 services/nginx.nix     |  7 +++++++
 6 files changed, 53 insertions(+)
 create mode 100644 services/guildhall.nix

diff --git a/common.nix b/common.nix
index ced8d64..9343663 100644
--- a/common.nix
+++ b/common.nix
@@ -126,6 +126,7 @@ in
     ./services/redlib.nix
     ./services/stardew-tracker.nix
     ./services/flowtrack.nix
+    ./services/guildhall.nix
     ./services/hardware-health.nix
     ./services/wan-watchdog.nix
     ./services/deployment.nix
diff --git a/flake.lock b/flake.lock
index cad03c3..16afe49 100644
--- a/flake.lock
+++ b/flake.lock
@@ -223,6 +223,26 @@
         "type": "github"
       }
     },
+    "guildhall": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1792327736,
+        "narHash": "sha256-rBD6icIYApcYSri+dEmg4Xtar6/LA9dfyHOHvpQaC7U=",
+        "ref": "refs/heads/main",
+        "rev": "9058039eb7d881d591cd6675199e798549b6f3b5",
+        "revCount": 1,
+        "type": "git",
+        "url": "https://forg.gregersen.it/rope/guildhall"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://forg.gregersen.it/rope/guildhall"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -472,6 +492,7 @@
     "root": {
       "inputs": {
         "flowtrack": "flowtrack",
+        "guildhall": "guildhall",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
         "loupe": "loupe",
diff --git a/flake.nix b/flake.nix
index 0d848ef..95f573b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -45,6 +45,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    guildhall = {
+      url = "git+https://forg.gregersen.it/rope/guildhall";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     stylix = {
       url = "github:nix-community/stylix/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -60,6 +65,7 @@
     , proton-cachyos-nix
     , stardew-tracker
     , flowtrack
+    , guildhall
     , ...
     } @ inputs:
     let
@@ -71,6 +77,7 @@
         stylix.nixosModules.stylix
         stardew-tracker.nixosModules.default
         flowtrack.nixosModules.default
+        guildhall.nixosModules.default
         ./settings/stylix.nix
       ];
       mkHost = hostname: extraModules: nixpkgs.lib.nixosSystem {
diff --git a/services/authelia.nix b/services/authelia.nix
index f383b55..72d315b 100644
--- a/services/authelia.nix
+++ b/services/authelia.nix
@@ -49,6 +49,7 @@ in
             { domain = "reddit.nordhammer.it";    policy = "one_factor"; }
             { domain = "panel.nordhammer.it";     policy = "one_factor"; subject = admin; }
             { domain = "stardew.nordhammer.it";  policy = "one_factor"; }
+            { domain = "guildhall.nordhammer.it"; policy = "one_factor"; }
             # Health data: only the two people the app knows about.
             { domain = "flowtrack.nordhammer.it"; policy = "one_factor"; subject = [ "user:kayla" "user:fred" ]; }
           ];
diff --git a/services/guildhall.nix b/services/guildhall.nix
new file mode 100644
index 0000000..e78b6ec
--- /dev/null
+++ b/services/guildhall.nix
@@ -0,0 +1,16 @@
+# services/guildhall.nix — Guildhall, the co-op idle game for friends.
+#
+# The game and NixOS module live in the standalone guildhall flake. nginx is
+# the only public listener; Authelia admits any account, and the game keys
+# each player on the Remote-User it passes through. Nightly snapshots sit
+# next to flowtrack's on the SSD branch of the pool.
+{ config, lib, ... }:
+{
+  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
+    services.guildhall = {
+      enable = true;
+      port = 8098;
+      backup.directory = "/mnt/disk2/backups/guildhall";
+    };
+  };
+}
diff --git a/services/nginx.nix b/services/nginx.nix
index c754b5f..7f99e7d 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -210,6 +210,13 @@ in
             proxy_set_header Remote-User $user;
           '';
         };
+        # Co-op idle game. Players are keyed on Remote-User, so nginx must
+        # always overwrite it with the Authelia identity.
+        "guildhall.nordhammer.it" = lib.recursiveUpdate (protectedProxy 8098) {
+          locations."/".extraConfig = autheliaAuthConfig + ''
+            proxy_set_header Remote-User $user;
+          '';
+        };
 
         # Pelican game panel. Can't turn off its own login (no such option
         # upstream), so Authelia is the outer gate and the Pelican account