wog: World of Guildhall at wog.nordhammer.it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/authelia.nix

@@ -75,6 +75,7 @@ in
             { domain = "panel.nordhammer.it";     policy = "one_factor"; subject = admin; }
             { domain = "stardew.nordhammer.it";  policy = "one_factor"; subject = household; }
             { domain = "guildhall.nordhammer.it"; policy = "one_factor"; }
+            { domain = "wog.nordhammer.it";       policy = "one_factor"; }
             # Health data: only the two people the app knows about.
             { domain = "flowtrack.nordhammer.it"; policy = "one_factor"; subject = [ "user:kayla" "user:fred" ]; }
           ];

services/nginx.nix

@@ -219,6 +219,13 @@ in
           '';
           locations."/join/".proxyPass = "http://127.0.0.1:8099";
         };
+        # World of Guildhall, same keying as Guildhall. Same accounts, no
+        # invite path of its own.
+        "wog.nordhammer.it" = lib.recursiveUpdate (protectedProxy 8100) {
+          locations."/".extraConfig = autheliaAuthConfig + ''
+            proxy_set_header Remote-User $user;
+          '';
+        };
 
         # Pelican game panel. Can't turn off its own login (no such option
         # upstream), so Authelia is the outer gate and the Pelican account

services/wog.nix

@@ -0,0 +1,16 @@
+# services/wog.nix — World of Guildhall, the WoW Classic–style co-op game.
+#
+# The game and NixOS module live in the standalone wog flake. nginx is the
+# only public listener; Authelia admits any account (Guildhall's invites
+# work here too), and the game keys each player on the Remote-User it
+# passes through. Nightly snapshots sit next to Guildhall's.
+{ config, lib, ... }:
+{
+  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
+    services.wog = {
+      enable = true;
+      port = 8100;
+      backup.directory = "/mnt/disk2/backups/wog";
+    };
+  };
+}