cal: run on Node 26 via socket activation

Swap Deno for nodejs-slim_26, which runs server.ts directly. Drops
DENO_DIR and CacheDirectory, which only existed to give Deno's module
cache a writable home under DynamicUser.

Listen on a unix socket like clippersnip rather than a TCP port.

1 files changed, 11 insertions, 8 deletions

diff --git a/hostnix/elmo/cal.nix b/hostnix/elmo/cal.nix
index 64950a4..54946a9 100644
--- a/hostnix/elmo/cal.nix
+++ b/hostnix/elmo/cal.nix
@@ -5,19 +5,22 @@
     "d /opt/cal 0755 joe users"
   ];
 
-  # TODO socket activation
+  systemd.sockets.cal = {
+    wantedBy = [ "sockets.target" ];
+    socketConfig = {
+      ListenStream = "/run/cal/socket";
+      SocketGroup = "nginx";
+      SocketMode = "0660";
+    };
+  };
+
   systemd.services.cal = {
-    # Deno writes its module cache under $HOME, which DynamicUser does not give
-    # us; point it at /var/cache/cal instead.
-    # TODO node
-    environment.DENO_DIR = "/var/cache/cal";
     serviceConfig = {
       Type = "exec";
       DynamicUser = true;
       WorkingDirectory = "/opt/cal";
       StateDirectory = "cal";
-      CacheDirectory = "cal";
-      ExecStart = "${pkgs.deno}/bin/deno run --allow-net --allow-read --allow-write=/opt/cal/web/events,/opt/cal/web/_site web/server.ts";
+      ExecStart = "${pkgs.nodejs-slim_26}/bin/node server.ts";
     };
   };
 
@@ -26,7 +29,7 @@
     useACMEHost = "elmo.mou.fo";
     forceSSL = true;
     locations."/" = {
-      proxyPass = "http://127.0.0.1:8000";
+      proxyPass = "http://unix:/run/cal/socket";
     };
   };
 }