Centralize Tensamin packages modules and release automation

modules/README.md

@@ -0,0 +1,106 @@
+# NixOS modules
+
+`import ./default.nix { inherit self; }` returns `default`, `iota`, `omikron`,
+`omega`, and `client`. `default` imports all four component modules. The flake's
+existing conditional import accepts this interface directly.
+
+These new files must be included in the consuming Git checkout for Git-backed
+flake evaluation. Verification used `path:` to include the untracked modules.
+
+All options live under `tensamin`, with no `services.tensamin` wrapper or legacy
+`services.iota`, `services.omikron`, or `services.omega` aliases.
+
+## Interfaces
+
+All components have `enable`, `package`, `bindAddress`, `port`, and
+`openFirewall`. Services are disabled by default. Package defaults resolve via
+`self.packages.${pkgs.stdenv.hostPlatform.system}`.
+
+| Component | Package | Bind address | Port | Open firewall |
+| --- | --- | --- | --- | --- |
+| `tensamin.iota` | `iota-daemon` | `0.0.0.0` | 1984 | true |
+| `tensamin.omikron` | `omikron` | `0.0.0.0` | 443 | true |
+| `tensamin.omega` | `omega` | `0.0.0.0` | 443 | true |
+| `tensamin.client` | `client-web` | `127.0.0.1` | 8080 | false |
+
+Iota, Omikron, and Omega open TCP and UDP. Client opens only TCP when requested.
+
+### Iota
+
+- `stateDir`, `cacheDir`, `runtimeDir`, `logDir` default to `/var/lib/iota`,
+  `/var/cache/iota`, `/run/iota`, `/var/log/iota`.
+- `assetDir` defaults to the central `iota` package's pinned source
+  `static/web` directory. This is upstream's shipped asset directory, currently
+  containing its 404 page, not the client application. Override it to serve
+  other assets.
+- `webMode` is `network` by default, or `loopback` or `disabled`. Upstream
+  requires TLS for both enabled modes. Set `bindAddress` explicitly for loopback.
+- `certFile` and `keyFile` are nullable runtime path strings, supplied together.
+  An enabled listener requires them unless `settingsFile` supplies complete TLS
+  configuration.
+- `omegaApiUrl` defaults to `https://omega.tensamin.net`.
+- `environmentFiles` is a list of runtime path strings, defaulting to `[]`.
+- `settings` contains YAML-compatible operator configuration, defaulting to `{}`.
+  Module listener and asset options take precedence. Startup rewrites the mutable
+  `stateDir/config.yaml`, preserving omitted `iota_id`, `omikron_host`,
+  `omikron_port`, and `omikron_id`. Explicit values, including null, override them.
+  Other daemon/operator edits to this file are replaced at the next startup.
+- `settingsFile` is a nullable runtime path string. It replaces generated
+  settings, with the same preservation of omitted discovery fields. Its listener
+  and TLS settings must agree with the module's firewall and capability options.
+  Relative paths resolve against `stateDir`, not the source file's directory.
+
+The systemd service and socket are named `iota`. IPC uses
+`${runtimeDir}/iota.sock`, mode `0660`, owned by `iota:iota`. Add authorized
+operators to the `iota` group. Daemon identities remain under
+`${stateDir}/identity`; the module does not reseed them. Exit code 75 forces a
+restart. Config paths, deployment mode, supervisor, and all mutable directories
+are passed through the upstream `IOTA_*` environment contract.
+
+### Omikron and Omega
+
+- `stateDir` defaults to `/var/lib/omikron` or `/var/lib/omega` and is the working
+  directory of the matching systemd service and service user.
+- Set either `acmeCertDir`, containing `fullchain.pem` and `key.pem`, or both
+  `certFile` and `keyFile`. All are nullable runtime path strings. Startup copies
+  the certificate to `certs/cert.pem` and converts the key to unencrypted PKCS8
+  at `certs/key.pem`, owned by the service user with mode `0600`.
+- `identityFile` and `publicIdentityFile` are nullable runtime path strings,
+  supplied together. Startup copies them to `omikron.mk` and `omikron.mpkb`, or
+  `omega.mk` and `omega.mpkb`. Null retains existing state or lets upstream
+  generate an identity. Supplied identities are reapplied on every startup.
+- `environment` is an attribute set of non-secret string settings, default `{}`.
+  Module-generated listener and Omikron discovery variables take precedence.
+- `environmentFiles` is a list of runtime environment paths, default `[]`.
+  Systemd loads these after the declared environment, so they can override it.
+  Keep listener variables consistent with firewall options. Omega requires
+  `DB_URL`; it uses file-based identities, not `PRIVATE_KEY`/`PUBLIC_KEY`.
+
+Omikron also requires positive `id` and `omegaTrustFile`, the runtime Omega public
+key bundle copied to `omega.mpkb`. `omegaHost` defaults to `tensamin.net` and
+`omegaPort` to the upstream default 9187. Set it to the deployed Omega listener
+port, whose module default is 443. These become `ID`, `OMEGA_HOST`, `OMEGA_PORT`,
+`RHO_PORT`, and `BIND_ADDRESS`. Omega uses `PORT` and `BIND_ADDRESS`.
+
+Trust and identity installation runs for both manual TLS and ACME. Configure
+certificate issuance separately and restart the corresponding service after
+renewal so it recopies certificates. Environment and secret path strings do not
+copy secret contents into the Nix store.
+
+### Client
+
+`hostName` defaults to `localhost`. The module enables nginx and adds that
+virtual host with an explicit HTTP listener at `bindAddress:port`, using
+`client-web`'s output root and SPA fallback to `/index.html`. Configure public
+TLS/proxy routing separately. It does not configure Anubis, guest accounts, or
+install the Electron client.
+
+## Verification
+
+The combined module was evaluated with actual central package outputs in
+minimal x86_64-linux and aarch64-linux NixOS container configurations. All
+assertions passed and `system.build.toplevel.drvPath` evaluated. Checks included
+both server TLS branches, all services disabled, Iota disabled-listener mode,
+a custom Iota runtime directory, and a custom nginx listener. Missing Omikron
+TLS produces the intended assertion. Evaluation does not build or start the
+applications.