From dd6f17c335641fe1454f8367c9cfdf3286ddada5 Mon Sep 17 00:00:00 2001
From: rope <fredrik@nordhammer.it>
Date: Fri, 23 Oct 2026 22:55:07 +0100
Subject: [PATCH] wog: World of Guildhall at wog.nordhammer.it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 common.nix            |  1 +
 flake.lock            | 21 +++++++++++++++++++++
 flake.nix             |  7 +++++++
 services/authelia.nix |  1 +
 services/nginx.nix    |  7 +++++++
 services/wog.nix      | 16 ++++++++++++++++
 6 files changed, 53 insertions(+)
 create mode 100644 services/wog.nix

diff --git a/common.nix b/common.nix
index 6a931a4..5dbaec8 100644
--- a/common.nix
+++ b/common.nix
@@ -128,6 +128,7 @@ in
     ./services/flowtrack.nix
     ./services/guildhall.nix
     ./services/guildhall-join.nix
+    ./services/wog.nix
     ./services/hardware-health.nix
     ./services/wan-watchdog.nix
     ./services/tv-detox.nix
diff --git a/flake.lock b/flake.lock
index 9c122ff..6780a75 100644
--- a/flake.lock
+++ b/flake.lock
@@ -502,6 +502,7 @@
         "redlib": "redlib",
         "stardew-tracker": "stardew-tracker",
         "stylix": "stylix",
+        "wog": "wog",
         "zen-browser": "zen-browser"
       }
     },
@@ -659,6 +660,26 @@
         "type": "github"
       }
     },
+    "wog": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1792792362,
+        "narHash": "sha256-7DYScQSd/DzW9PpKWeDMc8BN+MVLhtv4PLodSYJ9tpY=",
+        "ref": "refs/heads/main",
+        "rev": "71dd99795a28f681f8ac3c48cff3f2cf8606c75e",
+        "revCount": 1,
+        "type": "git",
+        "url": "https://forg.gregersen.it/rope/wog"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://forg.gregersen.it/rope/wog"
+      }
+    },
     "zen-browser": {
       "inputs": {
         "home-manager": [
diff --git a/flake.nix b/flake.nix
index 95f573b..5ad856f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -50,6 +50,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    wog = {
+      url = "git+https://forg.gregersen.it/rope/wog";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     stylix = {
       url = "github:nix-community/stylix/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -66,6 +71,7 @@
     , stardew-tracker
     , flowtrack
     , guildhall
+    , wog
     , ...
     } @ inputs:
     let
@@ -78,6 +84,7 @@
         stardew-tracker.nixosModules.default
         flowtrack.nixosModules.default
         guildhall.nixosModules.default
+        wog.nixosModules.default
         ./settings/stylix.nix
       ];
       mkHost = hostname: extraModules: nixpkgs.lib.nixosSystem {
diff --git a/services/authelia.nix b/services/authelia.nix
index 524efca..18b6ee6 100644
--- a/services/authelia.nix
+++ b/services/authelia.nix
@@ -75,6 +75,7 @@ in
             { domain = "panel.nordhammer.it";     policy = "one_factor"; subject = admin; }
             { domain = "stardew.nordhammer.it";  policy = "one_factor"; subject = household; }
             { domain = "guildhall.nordhammer.it"; policy = "one_factor"; }
+            { domain = "wog.nordhammer.it";       policy = "one_factor"; }
             # Health data: only the two people the app knows about.
             { domain = "flowtrack.nordhammer.it"; policy = "one_factor"; subject = [ "user:kayla" "user:fred" ]; }
           ];
diff --git a/services/nginx.nix b/services/nginx.nix
index 2c5e64f..a304a1a 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -219,6 +219,13 @@ in
           '';
           locations."/join/".proxyPass = "http://127.0.0.1:8099";
         };
+        # World of Guildhall, same keying as Guildhall. Same accounts, no
+        # invite path of its own.
+        "wog.nordhammer.it" = lib.recursiveUpdate (protectedProxy 8100) {
+          locations."/".extraConfig = autheliaAuthConfig + ''
+            proxy_set_header Remote-User $user;
+          '';
+        };
 
         # Pelican game panel. Can't turn off its own login (no such option
         # upstream), so Authelia is the outer gate and the Pelican account
diff --git a/services/wog.nix b/services/wog.nix
new file mode 100644
index 0000000..47bfad5
--- /dev/null
+++ b/services/wog.nix
@@ -0,0 +1,16 @@
+# services/wog.nix — World of Guildhall, the WoW Classic–style co-op game.
+#
+# The game and NixOS module live in the standalone wog flake. nginx is the
+# only public listener; Authelia admits any account (Guildhall's invites
+# work here too), and the game keys each player on the Remote-User it
+# passes through. Nightly snapshots sit next to Guildhall's.
+{ config, lib, ... }:
+{
+  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
+    services.wog = {
+      enable = true;
+      port = 8100;
+      backup.directory = "/mnt/disk2/backups/wog";
+    };
+  };
+}