add truth machine

flake.lock

@@ -799,6 +799,7 @@
         "stylix": "stylix",
         "treefmt-nix": "treefmt-nix_2",
         "trollshell": "trollshell",
+        "truth-machine": "truth-machine",
         "zerforschen-plus": "zerforschen-plus"
       }
     },
@@ -1091,6 +1092,26 @@
         "type": "github"
       }
     },
+    "truth-machine": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1792286440,
+        "narHash": "sha256-B9NYbg7xyzSrP/+g70jp0PfyikylMoPw7XAOCltHn6c=",
+        "ref": "refs/heads/main",
+        "rev": "a874d5d119847413be78f21f25868d668498c7c8",
+        "revCount": 8,
+        "type": "git",
+        "url": "https://forge.darkest.space/mara/truth.bat.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://forge.darkest.space/mara/truth.bat.git"
+      }
+    },
     "xwayland-satellite-stable": {
       "flake": false,
       "locked": {

flake.nix

@@ -97,6 +97,10 @@
         home-manager.follows = "home-manager";
       };
     };
+    truth-machine = {
+      url = "git+https://forge.darkest.space/mara/truth.bat.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     zerforschen-plus = {
       url = "git+https://forge.darkest.space/mara/zerforschen.plus.git";
       inputs.nixpkgs.follows = "nixpkgs";

nixosConfigurations/hyperforge/default.nix

@@ -3,6 +3,7 @@
     ./hardware.nix
     ./forgejo.nix
     ./nginx.nix
+    ./truth-machine.nix
   ];
 
   config = {

nixosConfigurations/hyperforge/truth-machine.nix

@@ -0,0 +1,21 @@
+{ truth-machine, ... }:
+let
+  domain = "truth.darkest.space";
+in
+{
+  imports = [ truth-machine.nixosModules.default ];
+
+  services = {
+    truth-machine = {
+      enable = true;
+      virtualHost = domain;
+      # ANTHROPIC_API_KEY, TRUTH_ADMIN_PASSWORD and TRUTH_ADMIN_PATH, placed manually
+      environmentFile = "/etc/secrets/truth-machine.env";
+    };
+
+    nginx.virtualHosts.${domain} = {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+}