From b1c9279c637956d134793431e0760d71a0e8bd97 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 2 Aug 2025 14:46:32 +0200
Subject: [PATCH] nixos: services: add thelounge

---
 modules/nixos/services/default.nix           |  1 +
 modules/nixos/services/thelounge/default.nix | 59 ++++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 modules/nixos/services/thelounge/default.nix

diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 27f8765..e03eca1 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -38,6 +38,7 @@
     ./servarr
     ./ssh-server
     ./tandoor-recipes
+    ./thelounge
     ./tlp
     ./transmission
     ./vikunja
diff --git a/modules/nixos/services/thelounge/default.nix b/modules/nixos/services/thelounge/default.nix
new file mode 100644
index 0000000..e224839
--- /dev/null
+++ b/modules/nixos/services/thelounge/default.nix
@@ -0,0 +1,59 @@
+# Web IRC client
+{ config, lib, ... }:
+let
+  cfg = config.my.services.thelounge;
+in
+{
+  options.my.services.thelounge = with lib; {
+    enable = mkEnableOption "The Lounge, a self-hosted web IRC client";
+
+    port = mkOption {
+      type = types.port;
+      default = 9050;
+      example = 4242;
+      description = "The port on which The Lounge will listen for incoming HTTP traffic.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.thelounge = {
+      enable = true;
+      inherit (cfg) port;
+
+      extraConfig = {
+        reverseProxy = true;
+      };
+    };
+
+    my.services.nginx.virtualHosts = {
+      irc = {
+        inherit (cfg) port;
+        # Proxy websockets for RPC
+        websocketsLocations = [ "/" ];
+
+        extraConfig = {
+          locations."/".extraConfig = ''
+            proxy_read_timeout 1d;
+          '';
+        };
+      };
+    };
+
+    services.fail2ban.jails = {
+      thelounge = ''
+        enabled = true
+        filter = thelounge
+        port = http,https
+      '';
+    };
+
+    environment.etc = {
+      "fail2ban/filter.d/thelounge.conf".text = ''
+        [Definition]
+        failregex = Authentication failed for user .* from <HOST>$
+                    Authentication for non existing user attempted from <HOST>$
+        journalmatch = _SYSTEMD_UNIT=thelounge.service
+      '';
+    };
+  };
+}