Fixes SSL issues.

flake.nix

@@ -23,7 +23,8 @@
           devShells.default = import ./shell.nix { inherit pkgs; };
           packages.frontend = pkgs.mmelodies.frontend;
         }
-      ) // {
+        ) // {
+          nixosModules.default = import ./nixos;
           overlay = 
           (final: super: {
             napalm = import inputs.napalm { pkgs = super; };

nixos/default.nix

@@ -0,0 +1,13 @@
+{pkgs, config, ...}:
+{
+  services.nginx.enable = true;
+
+  services.nginx.virtualHosts."${config.networking.hostName}" = {
+    addSSL = true;
+    sslCertificate = "/etc/ssl/snakeoil.crt";
+    sslCertificateKey = "/etc/ssl/snakeoil.key";
+    root = pkgs.mmelodies.frontend;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}

nixos/ssl/README.md

@@ -0,0 +1,28 @@
+## Using a local CA for a PWA on Android
+
+Generate selfsigned ssl keys with:
+```
+openssl genrsa -out ca.key
+openssl x509 -new -key ca.key -out ca.crt -subj '/CN=Motion Melodies Dummy CA' -extfile ca-options.txt
+
+openssl genrsa -out ssl/melodypond.key
+
+openssl req -new -sha256 -noenc -key melodypond.key -subj '/CN=melodypond' -out melodypond.csr
+openssl x509 -req -in melodypond.csr -CA ca.crt -CAkey ca.key -out melodypond.crt -extfile options.txt 
+
+cat melodypond.crt ca.crt > melodypond.chain.crt
+
+# Then manually copy melodypond.key and melodypond.chain.crt to /etc/ssl on the server.
+#   and onto the Android device used as the controller.
+```
+
+These keys can then be added to the Android device used as the controller by going to
+`Settings >> Security >> Credentials >> Install >> CA` then selecting the certificate
+and rebooting the device.
+
+If you are using a Firefox-based browser on the phone, you will also need to enable third party certificates
+in the Firefox app's developer settings.
+This can be accessed by tapping the logo on the about screen many times, then going to
+`Settings >> Secret Settings >> Use Third Party CAs`
+
+Firefox should now show the site as secure and allow installing the PWA.

nixos/ssl/ca-options.txt

@@ -0,0 +1 @@
+basicConstraints = CA:true

nixos/ssl/options.txt

@@ -0,0 +1 @@
+subjectAltName = DNS:melodypond, DNS:melodypond.lan