feat(nornsight): remove Norn Sight service and related configurations

systems/jeeves/default.nix

@@ -38,10 +38,5 @@ in
     };
   };
 
-  users.groups = {
-    nornsight = { };
-    nornsight-admin = { };
-  };
-
   system.stateVersion = "24.05";
 }

systems/jeeves/networking/firewall.nix

@@ -9,7 +9,6 @@ let
     jellyfin_http = 8096;
     jellyswarrm = 3100;
     nix_binary_cache = 5000;
-    nornsight = 8001;
     ollama = 11434;
     open_webui = 8080;
     postgresql = 5432;
@@ -30,7 +29,6 @@ in
       ports.jellyfin_http
       ports.jellyswarrm
       ports.nix_binary_cache
-      ports.nornsight
       ports.share
     ];
     allowedTCPPorts = [

systems/jeeves/services/nornsight.nix

@@ -1,107 +0,0 @@
-{ pkgs, ... }:
-let
-  vars = import ../vars.nix;
-  stateDir = "${vars.services}/nornsight";
-  appDir = "${stateDir}/app";
-  binPath = pkgs.lib.makeBinPath [
-    pkgs.binutils
-    pkgs.libpq
-    pkgs.postgresql
-    pkgs.stdenv.cc
-  ];
-  libraryPath = pkgs.lib.makeLibraryPath [
-    pkgs.libpq
-    pkgs.postgresql.lib
-  ];
-in
-{
-  systemd.tmpfiles.rules = [
-    "d ${stateDir} 0750 nornsight nornsight - -"
-  ];
-
-  users.users.nornsight = {
-    isSystemUser = true;
-    group = "nornsight";
-    home = stateDir;
-  };
-
-  systemd.services.nornsight = {
-    description = "Norn Sight";
-    after = [ "network-online.target" ];
-    wants = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-
-    environment = {
-      HOME = stateDir;
-      UV_CACHE_DIR = "${stateDir}/.cache/uv";
-      UV_PROJECT_ENVIRONMENT = "${appDir}/.venv";
-      UV_PYTHON = "${pkgs.python313}/bin/python3.13";
-      UV_PYTHON_DOWNLOADS = "never";
-      LD_LIBRARY_PATH = libraryPath;
-      LIBRARY_PATH = libraryPath;
-      PSYCOPG_IMPL = "python";
-    };
-
-    path = with pkgs; [
-      bash
-      coreutils
-      git
-      uv
-    ];
-
-    serviceConfig = {
-      Type = "simple";
-      User = "nornsight";
-      Group = "nornsight";
-      EnvironmentFile = "-${vars.secrets}/services/nornsight";
-      WorkingDirectory = stateDir;
-      Restart = "on-failure";
-      RestartSec = "5s";
-      StandardOutput = "journal";
-      StandardError = "journal";
-      NoNewPrivileges = true;
-      PrivateTmp = true;
-      ProtectHome = true;
-      ProtectSystem = "strict";
-      ReadWritePaths = [ stateDir ];
-    };
-
-    script = ''
-      set -eu
-      export PATH="${binPath}:$PATH"
-      export LD_LIBRARY_PATH="${libraryPath}:''${LD_LIBRARY_PATH:-}"
-      export LIBRARY_PATH="${libraryPath}:''${LIBRARY_PATH:-}"
-
-      : "''${NORN_SIGHT_REPO_URL:?NORN_SIGHT_REPO_URL is required}"
-      branch="''${NORN_SIGHT_BRANCH:-main}"
-
-      if [ -d "${appDir}/.git" ]; then
-        current_origin="$(git -C "${appDir}" remote get-url origin)"
-        if [ "$current_origin" != "$NORN_SIGHT_REPO_URL" ]; then
-          rm -rf "${appDir}"
-        fi
-      fi
-
-      if [ ! -d "${appDir}/.git" ]; then
-        git clone --branch "$branch" "$NORN_SIGHT_REPO_URL" "${appDir}"
-      else
-        cd "${appDir}"
-        git fetch origin "$branch"
-        git checkout "$branch"
-        git pull --ff-only origin "$branch"
-      fi
-
-      cd "${appDir}"
-      uv sync --upgrade
-      uv run python - <<'PY'
-      import ctypes.util
-      import os
-
-      print(f"LD_LIBRARY_PATH={os.environ.get('LD_LIBRARY_PATH')}")
-      print(f"LIBRARY_PATH={os.environ.get('LIBRARY_PATH')}")
-      print(f"libpq={ctypes.util.find_library('pq')}")
-      PY
-      exec uv run uvicorn pipelines.web.main:app --host 0.0.0.0 --port 8001
-    '';
-  };
-}

systems/portal-1/haproxy/default.nix

@@ -7,8 +7,6 @@ let
     "jellyfin"
     "share"
   ];
-  extraDomains = [ "www.norn-sight.com" ];
-
   makeCert = name: {
     name = "${name}.tmmworkshop.com";
     value = {
@@ -18,18 +16,7 @@ let
     };
   };
 
-  makeExtraCert = name: {
-    inherit name;
-    value = {
-      webroot = "/var/lib/acme/.challenges";
-      group = "acme";
-      reloadServices = [ "haproxy.service" ];
-    };
-  };
-
-  acmeServices =
-    map (domain: "acme-${domain}.tmmworkshop.com.service") domains
-    ++ map (domain: "acme-${domain}.service") extraDomains;
+  acmeServices = map (domain: "acme-${domain}.tmmworkshop.com.service") domains;
 in
 {
   networking.firewall.allowedTCPPorts = [
@@ -65,7 +52,7 @@ in
   security.acme = {
     acceptTerms = true;
     defaults.email = "Richie@tmmworkshop.com";
-    certs = builtins.listToAttrs ((map makeCert domains) ++ (map makeExtraCert extraDomains));
+    certs = builtins.listToAttrs ((map makeCert domains));
   };
 
   systemd = {

systems/portal-1/haproxy/haproxy.cfg

@@ -32,7 +32,7 @@ defaults
 #Application Setup
 frontend ContentSwitching
   bind [::]:80 v4v6
-  bind [::]:443 v4v6 ssl crt /var/lib/acme/audiobookshelf.tmmworkshop.com/full.pem crt /var/lib/acme/cache.tmmworkshop.com/full.pem crt /var/lib/acme/gems.tmmworkshop.com/full.pem crt /var/lib/acme/jellyfin.tmmworkshop.com/full.pem crt /var/lib/acme/share.tmmworkshop.com/full.pem crt /var/lib/acme/gitea.tmmworkshop.com/full.pem crt /var/lib/acme/www.norn-sight.com/full.pem
+  bind [::]:443 v4v6 ssl crt /var/lib/acme/audiobookshelf.tmmworkshop.com/full.pem crt /var/lib/acme/cache.tmmworkshop.com/full.pem crt /var/lib/acme/gems.tmmworkshop.com/full.pem crt /var/lib/acme/jellyfin.tmmworkshop.com/full.pem crt /var/lib/acme/share.tmmworkshop.com/full.pem crt /var/lib/acme/gitea.tmmworkshop.com/full.pem crt
   mode  http
 
   # ACME challenge routing (must be first)
@@ -45,7 +45,6 @@ frontend ContentSwitching
   acl host_share  hdr(host) -i share.tmmworkshop.com
   acl host_gitea  hdr(host) -i gitea.tmmworkshop.com
   acl host_gems  hdr(host) -i gems.tmmworkshop.com
-  acl host_norn_sight  hdr(host) -i www.norn-sight.com
 
   # --- Request logging ---
   # Capture the Host header and User-Agent so the httplog shows who is
@@ -117,7 +116,6 @@ frontend ContentSwitching
   use_backend share_nodes  if host_share
   use_backend gitea  if host_gitea
   use_backend gems  if host_gems
-  use_backend norn_sight  if host_norn_sight
 
 # Proxy Gitea's built-in SSH server over Tailscale to Jeeves. Port 22 remains
 # available to Endlessh on Portal.
@@ -169,7 +167,3 @@ backend gems
   option forwardfor
   timeout server 1h
   server gems jeeves:8002
-
-backend norn_sight
-  mode http
-  server server jeeves:8001

users/math/default.nix

@@ -36,8 +36,6 @@ in
         "hass"
         "libvirtd"
         "networkmanager"
-        "nornsight"
-        "nornsight-admin"
         "plugdev"
         "scanner"
         "transmission"

users/richie/default.nix

@@ -36,8 +36,6 @@ in
         "hass"
         "libvirtd"
         "networkmanager"
-        "nornsight"
-        "nornsight-admin"
         "ollama"
         "plugdev"
         "scanner"