documentation update

docs/constitution.md

@@ -9,8 +9,8 @@
 - Architecture: Flake-based repo using `flake-parts` with inputs for pkgs (stable/unstable), stylix, home-manager, sops-nix, and service overlays. Common modules are composed through `parts/core.nix` and `parts/hosts.nix`.
 - Module auto-import: `modules/modules.nix` auto-imports `.nix` files under `modules/apps`, `modules/dev`, `modules/scripts`, `modules/servers`, `modules/services`, `modules/shell`, and `modules/network`, excluding `librewolf.nix`. Factories live in `modules/factories/` (`mkserver`, `mkscript`), and shared options are in `modules/nix` and `modules/users`.
 - Hosts and toggles: Host definitions live in `hosts/<name>/configuration.nix` with host-specific toggles in `hosts/<name>/toggles.nix`. The `my` namespace carries toggles for apps/dev/scripts/services/shell, feature flags like `enableProxy` and `enableContainers`, and per-host `interfaces` and `ips` maps.
-- Main server and proxies: `my.mainServer` selects the host that should serve traffic by default (default `miniserver`; overridden to `server` in `hosts/server/toggles.nix`). Reverse proxies use helpers in `parts/core.nix` (`proxy`, `proxyReverse`, `proxyReverseFix`, `proxyReversePrivate`) and pick IPs from `my.ips` plus the hostName/ip set by `mkserver` options.
-- Secure hosts and secrets: `my.secureHost` gates SOPS secrets. Secure hosts load secrets from `secrets/*.yaml` and wireguard definitions; non-secure hosts (e.g., `hosts/emacs`) skip secret-dependent services. Default SOPS file is `secrets/secrets.yaml` via `config/base.nix`.
+- Main server and proxies: `my.mainServer` selects the host that should serve traffic by default (default `vps`). Reverse proxies use helpers in `parts/core.nix` (`proxy`, `proxyReverse`, `proxyReverseFix`, `proxyReversePrivate`) and pick IPs from `my.ips` plus the hostName/ip set by `mkserver` options. Nginx defaults to `proxyReverse` for any server with `enableProxy = true` unless `useDefaultProxy = false` or the server is listed in the Fix/Private proxy lists.
+- Secure hosts and secrets: `my.secureHost` gates SOPS secrets. Secure hosts load secrets from `secrets/*.yaml` and wireguard definitions; non-secure hosts (e.g., `hosts/emacs`) skip secret-dependent services. Default SOPS file is `secrets/secrets.yaml` via `config/base.nix`. Proxy-only services that need private certificates must still define their cert secrets when `enableProxy = true`.
 
 ## Coding Conventions
 - No blank lines between code blocks; keep markdown examples tight.
@@ -33,7 +33,7 @@ config.services = {
 - Factory: Shared option constructors in `modules/factories/` (use `mkserver` for server modules, `mkscript` for script units).
 - Options: Settings under the `my` namespace (e.g., `my.services.<service>`, `my.scripts.<script>`).
 - Toggles: Enablement maps in `hosts/<name>/toggles.nix` controlling categories (apps/dev/shell/scripts/services/servers/units) and features (`enableProxy`, `enableContainers`).
-- Servers: Reverse-proxied services under `modules/servers/`, normally created with `mkserver` options.
+- Servers: Reverse-proxied services under `modules/servers/`, normally created with `mkserver` options (including `useDefaultProxy` to opt out of default proxyReverse).
 - Scripts: Units defined via `mkscript` with `enable`, `install`, `service`, `users`, `timer`, and `package` fields.
 - Playbooks: Workflow guides under `docs/playbooks/` for repeatable tasks.
 - Reference map: Navigation index under `docs/reference/index.md` for paths and responsibilities.

docs/reference/index.md

@@ -23,8 +23,8 @@
 - Active hosts: `workstation`, `server`, `miniserver`, `galaxy`, `emacs`, `vps`.
 - Roles:
   - workstation: developer desktop; provides build power for distributed builds.
-  - server: primary services host (overrides `my.mainServer = "server"` and enables proxies/containers).
-  - miniserver: small-footprint server; default `mainServer` in shared options.
+  - server: primary services host; runs most services and WireGuard targets.
+  - miniserver: small-footprint server.
   - galaxy: small server variant using nixpkgs-small.
   - emacs: VM profile, `my.secureHost = false` for secret-free usage.
   - vps: Linode VPS image target, secure host with enrollment-based secrets.
@@ -32,8 +32,9 @@
 
 ## Proxy, Firewall, and Networking
 - Proxy enablement: `my.enableProxy` toggles Nginx reverse proxy; assertions require at least one `my.servers.*.enableProxy` when enabled.
-- Proxy helpers: use `parts/core.nix` helpers (`proxy`, `proxyReverse`, `proxyReverseFix` for header preservation, `proxyReversePrivate` for mutual TLS). `mkserver` supplies `host`, `ip`, `url`, and `enableProxy` defaults per service.
-- Main server selection: `my.mainServer` chooses where services live by default; `mkserver` sets `isLocal` based on this and picks IPs from `my.ips`.
+- Proxy helpers: use `parts/core.nix` helpers (`proxy`, `proxyReverse`, `proxyReverseFix` for header preservation, `proxyReversePrivate` for mutual TLS). `mkserver` supplies `host`, `ip`, `url`, `enableProxy`, and `useDefaultProxy`.
+- Default proxying: any server with `enableProxy = true` gets a `proxyReverse` vhost unless `useDefaultProxy = false` or it is listed in `proxyReverseFix` / `proxyReversePrivate`.
+- Main server selection: `my.mainServer` chooses where services live by default (default `vps`); `mkserver` sets `isLocal` based on this and picks IPs from `my.ips`.
 - Firewall generation: `inputs.self.lib.generateFirewallPorts` combines static ports, additional ports, and service ports from `my.servers` (excluding native firewall services). Use `my.network.firewall` settings and `getServicesWithNativeFirewall` to derive open ports.
 
 ## Secrets Map
@@ -46,7 +47,7 @@
   - `secrets/wireguard.yaml` → WireGuard peers and private keys.
   - `secrets/secrets.yaml` → default SOPS file (general secrets, fallback when unspecified).
   - `secrets/ssh/` → host SSH keys and related artifacts.
-- secureHost: Only hosts with `my.secureHost = true` consume SOPS entries and WireGuard interfaces. Keep secret references behind `lib.mkIf config.my.secureHost`.
+- secureHost: Only hosts with `my.secureHost = true` consume SOPS entries and WireGuard interfaces. Keep secret references behind `lib.mkIf config.my.secureHost`; proxy-only services that use private certs must still declare their cert secrets when `enableProxy = true`.
 
 ## Stylix and Theming
 - Stylix module: `config/stylix.nix` and stylix inputs in `flake.nix` apply theming. Host toggle `my.stylix.enable` controls activation (see host toggles).

modules/servers/synapse.nix

@@ -43,11 +43,6 @@ in
           owner = "matrix-synapse";
           group = "matrix-synapse";
         };
-        "iqQCY4iAWO-ca/pem" = {
-          sopsFile = ../../secrets/certs.yaml;
-          owner = "nginx";
-          group = "nginx";
-        };
         "matrix/key" = {
           sopsFile = ../../secrets/certs.yaml;
           owner = "matrix-synapse";
@@ -102,7 +97,15 @@ in
       };
     })
     (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
-      my.servers.synapse.useDefaultProxy = false;
+      sops.secrets."iqQCY4iAWO-ca/pem" = {
+        sopsFile = ../../secrets/certs.yaml;
+        owner = "nginx";
+        group = "nginx";
+      };
+      my.servers.synapse = {
+        useDefaultProxy = false;
+        certPath = config.sops.secrets."iqQCY4iAWO-ca/pem".path;
+      };
       services.nginx.virtualHosts = {
         "${cfgE.host}" = {
           enableACME = true;
@@ -128,11 +131,6 @@ in
             "/_matrix".proxyPass = "http://[${config.my.localhost6}]:${toString cfg.port}";
             "/_synapse/client".proxyPass = "http://[${config.my.localhost6}]:${toString cfg.port}";
           };
-          # extraConfig = ''
-          #   ssl_verify_client on;
-          #   ssl_client_certificate ${config.sops.secrets."iqQCY4iAWO-ca/pem".path};
-          #   error_page 403 /403.html;
-          # '';
         };
       };
     })