From a872e6f395d7b1f7f4ccccecc6fac3f4a3c3ee13 Mon Sep 17 00:00:00 2001
From: Scott Smitelli <scott@smitelli.com>
Date: Mon, 17 Mar 2025 18:42:49 -0400
Subject: [PATCH 1/8] Add scottsmitelli to webring_data.json

---
 webring_data.json | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/webring_data.json b/webring_data.json
index b9568ec..ef8a20d 100644
--- a/webring_data.json
+++ b/webring_data.json
@@ -52,5 +52,11 @@
     "title": "Data Collection",
     "author": "graphdev",
     "url": "https://blog.graphicalmethods.com"
+  },
+  {
+    "id": "scottsmitelli",
+    "title": "Scott Smitelli - Articles",
+    "author": "Scott Smitelli",
+    "url": "https://www.scottsmitelli.com/articles/"
   }
 ]

From 49be2f7e9d4dd4cc987816ba4aa23b2177638a39 Mon Sep 17 00:00:00 2001
From: Scott Smitelli <scott@smitelli.com>
Date: Mon, 17 Mar 2025 22:00:38 -0400
Subject: [PATCH 2/8] Permit scrolling in small viewports

---
 templates/index.html | 1 -
 1 file changed, 1 deletion(-)

diff --git a/templates/index.html b/templates/index.html
index 38d405e..cca30ae 100644
--- a/templates/index.html
+++ b/templates/index.html
@@ -5,7 +5,6 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1" />
         <style>
             body {
-                overflow: hidden;
                 padding: 0;
                 margin: 0;
                 height: 100vh;

From 55eb37bb470fd6816d06cd1d801187781c21fda4 Mon Sep 17 00:00:00 2001
From: DS <commits@sidhion.com>
Date: Mon, 31 Mar 2025 21:30:46 -0700
Subject: [PATCH 3/8] Configure host to use SSH certs on the host and client
 side.

---
 README.md                                     | 43 +++++++++++++++++
 flake.nix                                     |  2 +-
 host_config/bootstrap_host.sh                 | 47 +++++++++++++++++++
 .../code_server_disk.nix                      |  0
 code_server.nix => host_config/default.nix    |  4 ++
 host_config/sign_user_pub.sh                  | 25 ++++++++++
 host_config/ssh_certs/.gitignore              |  2 +
 host_config/ssh_certs/host_ca.pub             |  1 +
 host_config/ssh_certs/user_ca.pub             |  1 +
 justfile                                      |  7 ++-
 10 files changed, 129 insertions(+), 3 deletions(-)
 create mode 100755 host_config/bootstrap_host.sh
 rename code_server_disk.nix => host_config/code_server_disk.nix (100%)
 rename code_server.nix => host_config/default.nix (96%)
 create mode 100755 host_config/sign_user_pub.sh
 create mode 100644 host_config/ssh_certs/.gitignore
 create mode 100644 host_config/ssh_certs/host_ca.pub
 create mode 100644 host_config/ssh_certs/user_ca.pub

diff --git a/README.md b/README.md
index 39b3ba0..c8f495e 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,41 @@ There's already a `.vscode` directory which should direct VSCode to enable the D
 
 # Infrastructure
 
+## Setting up SSH access
+
+You'll need to trust the SSH certificate authority that generates SSH keys for Epesooj's hosts.
+The CA's public key is in `./host_config/ssh_certs/host_ca.pub`.
+
+This is the template for the SSH `known_hosts` entry:
+
+```
+@cert-authority <dns name or ip address> <CONTENTS OF host_ca.pub>
+```
+
+For example:
+
+```
+@cert-authority code.akols.com ssh-ed25519 AAAA...
+```
+
+## Signing a user's public SSH key to give them host access
+
+Run `just sign_user_key <username> <user_pub_key_path>`.
+This will by default give them `root` access.
+Check the definition of this `just` command to see how to give them access to different user(s).
+
+Once this is done, give them the signed public key (it'll be a file in the same directory as `<user_pub_key_path>` with the `-cert.pub` suffix) and tell them to add the `CertificateFile` option to their SSH config to make sure it'll also present the signed public key.
+For example:
+
+```
+Host epesooj
+  User root
+  HostName code.akols.com
+  IdentityFile ~/.ssh/epesooj_personal.pub
+  CertificateFile ~/.ssh/epesooj_personal-cert.pub
+  IdentitiesOnly yes
+```
+
 ## Nixifying a new host
 
 If you have a bunch of SSH keys in your SSH agent and get errors when trying to SSH into a fresh host, you may need to temporarily add the following config to your SSH config (obviously change the details for your case).
@@ -50,7 +85,15 @@ Host 188.245.194.78
   IdentitiesOnly yes
 ```
 
+Once you can SSH into the host normally, run `just nixify_host <hostname> "code" "<dns name>,<ip address>"`.
+For example: `just nixify_host epesooj-code-0001 code "code.akols.com,188.245.194.78"`.
+
+This command requires you to have the key for the Epesooj Host SSH certificate authority.
+If you don't have it, contact someone who does.
+
 ## Deploying the webring
 
 You should have a `.env` file with the id and deploy key for each script in the webring, as well as a key to deploy the index page to bunny.
 When you have this, run `deno task deploy`.
+You'll need the API keys required to deploy these.
+If you don't have them, contact someone who does.
diff --git a/flake.nix b/flake.nix
index 784d0dc..d8ec428 100644
--- a/flake.nix
+++ b/flake.nix
@@ -21,7 +21,7 @@
       systems = [ "x86_64-linux" ];
 
       imports = [
-        ./code_server.nix
+        ./host_config
       ];
 
       flake =
diff --git a/host_config/bootstrap_host.sh b/host_config/bootstrap_host.sh
new file mode 100755
index 0000000..cbf2341
--- /dev/null
+++ b/host_config/bootstrap_host.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
+host_ca_key="${SCRIPT_DIR}/ssh_certs/host_ca"
+user_ca_pub="${SCRIPT_DIR}/ssh_certs/user_ca.pub"
+
+if [ ! -f "${host_ca_key}" ]
+then
+  echo "Host CA key not found."
+  exit 1
+fi
+
+if [ ! -f "${user_ca_pub}" ]
+then
+  echo "Public User CA key not found."
+  exit 1
+fi
+
+temp=$(mktemp -d)
+
+cleanup() {
+  rm -rf "${temp}"
+}
+# trap cleanup EXIT
+
+host_type=$1
+hostname=$2
+extra_names=${3:-}
+
+principal_names="${hostname}"
+
+if [ ! -z "${extra_names}" ]
+then
+    principal_names="${principal_names},${extra_names}"
+fi
+
+install -d -m755 "${temp}/persisted/etc/ssh"
+ssh-keygen -t ed25519 -f "${temp}/persisted/etc/ssh/ssh_host_ed25519_key" -C '' -N ''
+ssh-keygen -s ${host_ca_key} -I ${hostname} -h -n "${principal_names}" -V +52w "${temp}/persisted/etc/ssh/ssh_host_ed25519_key.pub"
+
+cp "${user_ca_pub}" "${temp}/persisted/etc/ssh/user_cas.pub"
+
+echo "${temp}"
+
+#nix run github:nix-community/nixos-anywhere -- --extra-files "${temp}" --flake .#${host_type} --target-host root@${hostname}
diff --git a/code_server_disk.nix b/host_config/code_server_disk.nix
similarity index 100%
rename from code_server_disk.nix
rename to host_config/code_server_disk.nix
diff --git a/code_server.nix b/host_config/default.nix
similarity index 96%
rename from code_server.nix
rename to host_config/default.nix
index 889ed5e..ea9b4e5 100644
--- a/code_server.nix
+++ b/host_config/default.nix
@@ -96,6 +96,10 @@
         settings = {
           PasswordAuthentication = false;
         };
+        extraConfig = ''
+          HostCertificate /persisted/etc/ssh/ssh_host_ed25519_key-cert.pub
+          TrustedUserCAKeys /persisted/etc/ssh/user_cas.pub
+        '';
       };
 
       users.users.root = {
diff --git a/host_config/sign_user_pub.sh b/host_config/sign_user_pub.sh
new file mode 100755
index 0000000..edf614d
--- /dev/null
+++ b/host_config/sign_user_pub.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
+user_ca_key="${SCRIPT_DIR}/ssh_certs/user_ca"
+
+if [ ! -f "${user_ca_key}" ]
+then
+  echo "User CA key not found."
+  exit 1
+fi
+
+username=$1
+principals=$2
+user_pub=$3
+
+if [ ! -f "${user_pub}" ]
+then
+    echo "User public key not found."
+    exit 1
+fi
+
+ssh-keygen -s "${user_ca_key}" -I "${username}" -n "${principals}" -V +52w "${user_pub}"
+echo "Done!"
diff --git a/host_config/ssh_certs/.gitignore b/host_config/ssh_certs/.gitignore
new file mode 100644
index 0000000..b8718ec
--- /dev/null
+++ b/host_config/ssh_certs/.gitignore
@@ -0,0 +1,2 @@
+host_ca
+user_ca
diff --git a/host_config/ssh_certs/host_ca.pub b/host_config/ssh_certs/host_ca.pub
new file mode 100644
index 0000000..1714776
--- /dev/null
+++ b/host_config/ssh_certs/host_ca.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJygYxMUdGgApUE3KirRQVgG2X5zWurIBPbwEc10FxDi epesooj host ca
diff --git a/host_config/ssh_certs/user_ca.pub b/host_config/ssh_certs/user_ca.pub
new file mode 100644
index 0000000..248ea65
--- /dev/null
+++ b/host_config/ssh_certs/user_ca.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINdiqYdA3pm9yKgR5hFlL7ZeSV3xeKH9HwyNwaxY6yZZ epesooj user ca
diff --git a/justfile b/justfile
index bd926c2..1fcde48 100644
--- a/justfile
+++ b/justfile
@@ -4,5 +4,8 @@ default:
 build_nixos_config host_type="code":
   nix build .#nixosConfigurations.{{host_type}}.config.system.build.toplevel
 
-nixify_host hostname host_type="code":
-  nix run github:nix-community/nixos-anywhere -- --flake .#{{host_type}} --target-host root@{{hostname}}
+nixify_host hostname host_type="code" extra_names="":
+  ./host_config/bootstrap_host.sh {{host_type}} {{hostname}} {{extra_names}}
+
+sign_user_key username user_pub_key principals="root":
+  ./host_config/sign_user_pub.sh {{username}} {{principals}} {{user_pub_key}}

From 7ef2fd83a15325cd9202e666c39c3ff6b6d0d365 Mon Sep 17 00:00:00 2001
From: DS <commits@sidhion.com>
Date: Mon, 31 Mar 2025 22:46:55 -0700
Subject: [PATCH 4/8] Properly purge CDN cache.

---
 scripts/bunny_api/main.ts | 18 ++++++++----------
 scripts/deploy_bunny.ts   |  6 +++---
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/scripts/bunny_api/main.ts b/scripts/bunny_api/main.ts
index 0603140..1d6133c 100644
--- a/scripts/bunny_api/main.ts
+++ b/scripts/bunny_api/main.ts
@@ -90,21 +90,21 @@ export async function uploadFile(filepath: string, contents: Uint8Array) {
   }
 }
 
-export async function purgePath(filepath: string) {
-  const cdnBaseUrlEnvName = 'BUNNY_CDN_BASE_URL';
-  const cdnBaseUrl = Deno.env.get(cdnBaseUrlEnvName);
+export async function purgeCDNCache() {
+  const pullZoneIdEnvName = 'BUNNY_PULL_ZONE_ID';
+  const pullZoneId = Deno.env.get(pullZoneIdEnvName);
   const accessKeyEnvName = 'BUNNY_ACCESS_KEY';
   const accessKey = Deno.env.get(accessKeyEnvName);
 
-  if (cdnBaseUrl === undefined) {
+  if (pullZoneId === undefined) {
     throw new Error(
-      `Can't purge cache for '${filepath}' because we don't know the CDN base URL. Please set it by setting the environment variable '${cdnBaseUrlEnvName}'.`
+      `Can't purge CDN cache for because we don't know the pull zone ID. Please set it by setting the environment variable '${pullZoneIdEnvName}'.`
     );
   }
 
   if (accessKey === undefined) {
     throw new Error(
-      `Can't purge cache for '${filepath}' because we don't have an API key. Please set it by setting the environment variable '${accessKeyEnvName}'.`
+      `Can't purge CDN cache because we don't have an API key. Please set it by setting the environment variable '${accessKeyEnvName}'.`
     );
   }
 
@@ -114,9 +114,7 @@ export async function purgePath(filepath: string) {
     accesskey: accessKey,
   };
 
-  const fetchUrl = new URL(`https://api.bunny.net/purge`);
-  fetchUrl.searchParams.append('async', 'false');
-  fetchUrl.searchParams.append('url', `${cdnBaseUrl}/${filepath}`);
+  const fetchUrl = `https://api.bunny.net/pullzone/${pullZoneId}/purgeCache`;
 
   const res = await fetch(fetchUrl.toString(), {
     method: 'POST',
@@ -125,6 +123,6 @@ export async function purgePath(filepath: string) {
 
   if (!res.ok) {
     console.error(await res.text());
-    throw new Error(`Failed to purge cache: ${res.statusText}`);
+    throw new Error(`Failed to purge CDN cache: ${res.statusText}`);
   }
 }
diff --git a/scripts/deploy_bunny.ts b/scripts/deploy_bunny.ts
index 3d1fb39..29367b3 100644
--- a/scripts/deploy_bunny.ts
+++ b/scripts/deploy_bunny.ts
@@ -1,5 +1,5 @@
 import { join } from '@std/path';
-import { deployScript, purgePath, uploadFile } from './bunny_api/main.ts';
+import { deployScript, purgeCDNCache, uploadFile } from './bunny_api/main.ts';
 
 if (import.meta.main) {
   console.log(`Attempting to upload index.html`);
@@ -8,8 +8,8 @@ if (import.meta.main) {
   await uploadFile('index.html', indexContents);
   console.log(`Done!`);
 
-  console.log(`Attempting to purge the cache for index.html`);
-  await purgePath('index.html');
+  console.log(`Attempting to purge the CDN cache.`);
+  await purgeCDNCache();
   console.log(`Done!`);
 
   for (const dirEntry of Deno.readDirSync(

From 33b494a09c9c8937650e19cd791db48f4564810d Mon Sep 17 00:00:00 2001
From: Ruby Iris Juric <ruby@srxl.me>
Date: Mon, 19 May 2025 17:01:27 +1000
Subject: [PATCH 5/8] add foxgirl.engineering to the webring

---
 webring_data.json | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/webring_data.json b/webring_data.json
index ef8a20d..c122b74 100644
--- a/webring_data.json
+++ b/webring_data.json
@@ -58,5 +58,11 @@
     "title": "Scott Smitelli - Articles",
     "author": "Scott Smitelli",
     "url": "https://www.scottsmitelli.com/articles/"
+  },
+  {
+    "id": "srxl",
+    "title": "ruby's site",
+    "author": "ruby iris juric",
+    "url": "https://foxgirl.engineering"
   }
 ]

From bfcfd4205fa539b4d8cd607a7d92bf2dff6df912 Mon Sep 17 00:00:00 2001
From: entropic <entropic_eng@fastmail.com>
Date: Tue, 1 Jul 2025 02:49:07 +0000
Subject: [PATCH 6/8] add entropic to webring

---
 webring_data.json | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/webring_data.json b/webring_data.json
index c122b74..2830605 100644
--- a/webring_data.json
+++ b/webring_data.json
@@ -64,5 +64,11 @@
     "title": "ruby's site",
     "author": "ruby iris juric",
     "url": "https://foxgirl.engineering"
+  },
+  {
+    "id": "entropic"
+    "title": "Entropic"
+    "author": "Entropic"
+    "url": "https://entropic.mataroa.blog/"
   }
 ]

From bbe979dcab1d72de0fccb9f5c194e32a85814b96 Mon Sep 17 00:00:00 2001
From: entropic <entropic_eng@fastmail.com>
Date: Tue, 1 Jul 2025 08:22:02 +0000
Subject: [PATCH 7/8] Update webring_data.json

---
 webring_data.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/webring_data.json b/webring_data.json
index 2830605..6afefe5 100644
--- a/webring_data.json
+++ b/webring_data.json
@@ -66,9 +66,9 @@
     "url": "https://foxgirl.engineering"
   },
   {
-    "id": "entropic"
-    "title": "Entropic"
-    "author": "Entropic"
+    "id": "entropic",
+    "title": "Entropic",
+    "author": "Entropic",
     "url": "https://entropic.mataroa.blog/"
   }
 ]

From ba9bc12dfe6c47641c9c8b0536d3559f714f0be9 Mon Sep 17 00:00:00 2001
From: DS <commits@sidhion.com>
Date: Tue, 1 Jul 2025 01:54:41 -0700
Subject: [PATCH 8/8] Update flake lock for latest version of forgejo and other
 dependencies.

---
 flake.lock | 97 +++++++++++++-----------------------------------------
 1 file changed, 22 insertions(+), 75 deletions(-)

diff --git a/flake.lock b/flake.lock
index 32a38dd..ec46993 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739841949,
-        "narHash": "sha256-lSOXdgW/1zi/SSu7xp71v+55D5Egz8ACv0STkj7fhbs=",
+        "lastModified": 1750903843,
+        "narHash": "sha256-Ng9+f0H5/dW+mq/XOKvB9uwvGbsuiiO6HrPdAcVglCs=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "15dbf8cebd8e2655a883b74547108e089f051bf0",
+        "rev": "83c4da299c1d7d300f8c6fd3a72ac46cb0d59aae",
         "type": "github"
       },
       "original": {
@@ -25,11 +25,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1738453229,
-        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
+        "lastModified": 1749398372,
+        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
+        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
         "type": "github"
       },
       "original": {
@@ -38,38 +38,18 @@
         "type": "github"
       }
     },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "nil": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay"
+        ]
       },
       "locked": {
-        "lastModified": 1732053863,
-        "narHash": "sha256-DCIVdlb81Fct2uwzbtnawLBC/U03U2hqx8trqTJB7WA=",
+        "lastModified": 1751341694,
+        "narHash": "sha256-zXag1+8iZC3H5yVFP7KhIi4ps9z8xKrFIkyaeXlZ7Uo=",
         "owner": "oxalica",
         "repo": "nil",
-        "rev": "2e24c9834e3bb5aa2a3701d3713b43a6fb106362",
+        "rev": "b043bfe1f3f4c4be4b688e24c5ae96e81f525805",
         "type": "github"
       },
       "original": {
@@ -80,11 +60,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1740126099,
-        "narHash": "sha256-ozoOtE2hGsqh4XkTJFsrTkNxkRgShxpQxDynaPZUGxk=",
+        "lastModified": 1751271578,
+        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "32fb99ba93fea2798be0e997ea331dd78167f814",
+        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
         "type": "github"
       },
       "original": {
@@ -96,14 +76,17 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1738452942,
-        "narHash": "sha256-vJzFZGaCpnmo7I6i416HaBLpC+hvcURh/BQwROcGIp8=",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/072a6db25e947df2f31aab9eccd0ab75d5b2da11.tar.gz"
+        "lastModified": 1748740939,
+        "narHash": "sha256-rQaysilft1aVMwF14xIdGS3sj1yHlI6oKQNBRTF40cc=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "656a64127e9d791a334452c6b6606d17539476e2",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/072a6db25e947df2f31aab9eccd0ab75d5b2da11.tar.gz"
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
       }
     },
     "root": {
@@ -113,42 +96,6 @@
         "nil": "nil",
         "nixpkgs": "nixpkgs"
       }
-    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "nil",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1731983527,
-        "narHash": "sha256-JECaBgC0pQ91Hq3W4unH6K9to8s2Zl2sPNu7bLOv4ek=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "71287228d96e9568e1e70c6bbfa3f992d145947b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",