hainich: hacky version of thelounge as webchat

Intended for KontraIAA; requirements were that it should be a simple and
non-confusing as possible.

I tried both KiwiIRC and thelounge, and found both horrible to
package (a fact not helped by the somewhat opaque structure of
nixpkgs.nodePackages, which does contain a version of thelounge but
will apparently ignore overrides of the src attribute).

Instead, this now contains a very hacky version of thelounge, which
merely takes the already-built version from nixpkgs and glues some extra
css to it which hides potentially confusing fields.

Things hidden on the "connect" screen:
 - the "name" field (since thelounge offers "nick" "name" and "realname"
   by default, which seems too much for something embedded on a website)
 - the "I have a password" checkbox

Things hidden on the general view:
 - the button to open the side panel (the panel itself is not hidden,
   and will appear by itself on wider layouts), so that users will only
   see that one channel
 - the "channel options" menu (which includes a "leave channel" option
   which would effectively break the webchat)

Things not addressed:
 - thelounge has autocompletion for /join /leave, etc. Do we want to
   disable that as well?
 - It would probably useful to suppress all the "x joined the channel"
   messages. Thelounge supports this, but apparently doesn't support
   setting it as default?

Misc:
 - for now, users will be connected to #thelounge on libera.chat, which
   appears to be okay with being used as an experimental channel
 - I allowed prefetching link previews, but only on the server's side
   (i.e. users' browsers won't fetch content from arbitrary sites)
 - not yet tested on hainich, but should work (tested in a NixOS
   container)
 - currently assumes a "webchat.voc.hacc.space" domain (I think we had a
   voc domain? but I forgot where it is …)

hosts/hainich/configuration.nix

@@ -20,6 +20,7 @@
     ./services/monitoring.nix
     ./services/workadventure.nix
     ./services/mattermost.nix
+    ./services/thelounge.nix
   ];
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;

hosts/hainich/services/thelounge.nix

@@ -0,0 +1,69 @@
+{ config, lib, pkgs, ... }:
+
+let
+  # necessary since overlays won't propagate into the
+  # container's config
+  thelounge = pkgs.thelounge-hacked;
+in
+{
+  containers.thelounge = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "192.168.100.70";
+    localAddress = "192.168.100.71";
+
+    config = {pkgs, config, ...}: {
+
+      services.thelounge = {
+        enable = true;
+
+        extraConfig = {
+          public = true;
+          # respect X-Forwarded-For
+          reverseProxy = true;
+          defaults = {
+            name = "libera chat";
+            host = "irc.eu.libera.chat";
+            port = 6697;
+            # encrypt things!
+            tls = true;
+            # yes, please do actually check the cert …
+            rejectUnauthorized = true;
+            nick = "Guest%%%%";
+            join = "#thelounge";
+          };
+          lockNetwork = true;
+
+          # don't log messages (default is text / sqlite)
+          messageStorage = [];
+
+          # darker theme
+          #theme = "morning";
+
+          # these three should result in having link previews
+          # which are fetched only by the server, then proxied
+          # (i.e. clients won't directly connect to arbitrary
+          # domains to get previews)
+          prefetch = true;
+          prefetchStorage = true;
+          disableMediaPreview = true;
+
+          leaveMessage = "happy haccing";
+        };
+      };
+
+      # override the package we use
+      systemd.services.thelounge.serviceConfig.ExecStart =
+        pkgs.lib.mkForce "${thelounge}/bin/thelounge start";
+
+      networking.firewall.allowedTCPPorts = [ 9000 ];
+    };
+  };
+
+  services.nginx.virtualHosts."webchat.voc.hacc.space" = {
+    locations."/".proxyPass =
+      "http://${config.containers.thelounge.localAddress}:9000";
+    enableACME = true;
+    forceSSL = true;
+  };
+}

pkgs/default.nix

@@ -35,6 +35,26 @@ let
     });
 
     mattermost = callPackage ./mattermost {};
+
+    # a version of the lounge with some extra css that
+    # hides things the hacc-voc doesn't need
+    thelounge-hacked = pkgs.stdenv.mkDerivation {
+      name = "thelounge-hacked";
+      src = pkgs.thelounge;
+
+      phases = [ "buildPhase" "installPhase" ];
+      buildPhase = ''
+        cp $src/* -r .
+        chmod 777 lib/node_modules/thelounge/public/css/style.css
+        cat ${./thelounge/css-patch.css} >> lib/node_modules/thelounge/public/css/style.css
+      '';
+
+      installPhase = ''
+        mkdir -p $out
+        cp * -r $out
+      '';
+    };
+
     inherit (unstable) bottom;
   };
 

pkgs/thelounge/css-patch.css

@@ -0,0 +1,24 @@
+
+/* Hides extra fields on connect screen */
+.connect-row:nth-of-type(4) {
+    display: none !important;
+}
+
+.connect-row:nth-of-type(2) {
+    display: none !important;
+}
+
+.connect-row:nth-of-type(5) {
+    display: none !important;
+}
+
+
+/* Hides side panel button */
+.header > button:first-child {
+    display: none !important;
+}
+
+/* Hides channel options button (includes leave option) */
+.header > button:nth-last-child(2) {
+    display: none !important;
+}