From 161c42b2fa8d413d890023cb3cb25fd803ae569b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Wed, 11 Nov 2026 23:40:47 +0100
Subject: [PATCH] hetzner-vpn2: serve /media/ on hyperhive.darkest.space from
 /var/lib/hyperhive-media

---
 nixosConfigurations/hetzner-vpn2/nginx.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nixosConfigurations/hetzner-vpn2/nginx.nix b/nixosConfigurations/hetzner-vpn2/nginx.nix
index b80aa65..5576ee4 100644
--- a/nixosConfigurations/hetzner-vpn2/nginx.nix
+++ b/nixosConfigurations/hetzner-vpn2/nginx.nix
@@ -15,6 +15,8 @@ in
     defaults.email = "acme@zerforschen.plus";
   };
 
+  systemd.tmpfiles.rules = [ "d /var/lib/hyperhive-media 0755 root root -" ];
+
   systemd.services = {
     nginx.serviceConfig.SupplementaryGroups = [ "anubis" ];
     anubis-main.serviceConfig.SupplementaryGroups = [ "nginx" ];
@@ -51,6 +53,10 @@ in
           forceSSL = true;
           enableACME = true;
           root = hyperhive-website.packages.${pkgs.stdenv.hostPlatform.system}.default;
+          # the site root is a store path (replaced every deploy), so large
+          # media lives in its own dir, uploaded by hand:
+          #   scp gource-hyperhive.webm root@hetzner-vpn2:/var/lib/hyperhive-media/
+          locations."/media/".alias = "/var/lib/hyperhive-media/";
         };
 
         "trollhive.monster" = {