From 9392749e66504c9df73c5c9b3ef489eeb088c4a6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 13:05:22 -0400
Subject: [PATCH] mollysocket: init

Add mollysocket so we can use ntfy for molly (signal)
---
 configuration.nix           |   2 ++
 modules/age-secrets.nix     |   6 ++++++
 secrets/mollysocket-env.age | Bin 0 -> 359 bytes
 service-configs.nix         |   8 ++++++++
 services/mollysocket.nix    |  36 ++++++++++++++++++++++++++++++++++++
 5 files changed, 52 insertions(+)
 create mode 100644 secrets/mollysocket-env.age
 create mode 100644 services/mollysocket.nix

diff --git a/configuration.nix b/configuration.nix
index 515fa79..a72df29 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -69,6 +69,8 @@
 
     ./services/ntfy.nix
     ./services/ntfy-alerts.nix
+
+    ./services/mollysocket.nix
   ];
 
   services.kmscon.enable = true;
diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index ab42655..c380aba 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -88,5 +88,11 @@
       file = ../secrets/firefox-syncserver-env.age;
       mode = "0400";
     };
+
+    # MollySocket env (MOLLY_VAPID_PRIVKEY + MOLLY_ALLOWED_UUIDS)
+    mollysocket-env = {
+      file = ../secrets/mollysocket-env.age;
+      mode = "0400";
+    };
   };
 }
diff --git a/secrets/mollysocket-env.age b/secrets/mollysocket-env.age
new file mode 100644
index 0000000000000000000000000000000000000000..15bcdbd23c22ea9f67e6aa7ab588a754a86dea2f
GIT binary patch
literal 359
zcmZQ@_Y83kiVO&0Fr4IXvSV50dxiJ+et!+D{oPQOBv#qvzfH0FoAja|ytA`vpRBOY
zUG+%D_q)oq<LayA=KnhJ#pV*XY5GJ9;k6HMJDnA&vVLIaIxq7;$ir!Cl$(BUJiC%T
z@!!K4_slj1Upc1jE4^sXg@2|o+RnA6s&X?|-1zgsnrBk(oz!)+9z<X2eBLG6;%H@i
zxb42;S}|oCN8b&+`$hg&UX|CKwB}N?(cZEg+Xt@_&Hb;2>vpd5pE&ze5leS(aGGoU
zf{z!N+$GbFg_?;N7qM#g>v;X+c=<1&MD=}n+1jgod_0`<y}P#eb$85N9kb=|yR%Q1
zZHkaoyL5;1nP9r#^Gy@Btew-m@}mBO4o8_^%4fEnl~w!UtNtwW{=}4*TSAv@dU~Ak
zz|rN8#XIh}zf*l#&}=Ym@%>A?C&cipltm^suFG<FOtA`VI@odg({v%uWARINE^dwZ
V5dMPowSquvhqGtIzy7WxjsQi^v+w`_

literal 0
HcmV?d00001

diff --git a/service-configs.nix b/service-configs.nix
index ea35cf5..b6d0502 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -149,6 +149,10 @@ rec {
         port = 5000;
         proto = "tcp";
       };
+      mollysocket = {
+        port = 8020;
+        proto = "tcp";
+      };
     };
   };
 
@@ -219,6 +223,10 @@ rec {
     domain = "ntfy.${https.domain}";
   };
 
+  mollysocket = {
+    domain = "mollysocket.${https.domain}";
+  };
+
   livekit = {
     domain = "livekit.${https.domain}";
   };
diff --git a/services/mollysocket.nix b/services/mollysocket.nix
new file mode 100644
index 0000000..e35c01b
--- /dev/null
+++ b/services/mollysocket.nix
@@ -0,0 +1,36 @@
+{
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "mollysocket" service_configs.zpool_ssds [
+      "/var/lib/private/mollysocket"
+    ])
+    (lib.serviceFilePerms "mollysocket" [
+      "Z /var/lib/private/mollysocket 0700 root root"
+    ])
+  ];
+
+  services.mollysocket = {
+    enable = true;
+
+    settings = {
+      host = "127.0.0.1";
+      port = service_configs.ports.private.mollysocket.port;
+
+      # Explicitly allow our self-hosted ntfy instance.
+      # Local-network endpoints are denied by default for security.
+      allowed_endpoints = [ "https://${service_configs.ntfy.domain}" ];
+      # allowed_uuids set via MOLLY_ALLOWED_UUIDS in environmentFile
+    };
+
+    environmentFile = config.age.secrets.mollysocket-env.path;
+  };
+
+  services.caddy.virtualHosts."${service_configs.mollysocket.domain}".extraConfig = ''
+    reverse_proxy h2c://127.0.0.1:${builtins.toString service_configs.ports.private.mollysocket.port}
+  '';
+}