From f8a873bd06b106a69e5d62eb1b4bd0efac968143 Mon Sep 17 00:00:00 2001
From: DannyDannyDanny <dth@taiga.ai>
Date: Mon, 8 Jun 2026 22:27:32 +0200
Subject: [PATCH] nixos: add tdpixi service (port 8093) + vps-relay vhost

Idle Tower Defence Mini App by @plasmagoat forked from
github.com/plasmagoat/TDPixi. Pure static FastAPI serve,
no DB. Proxied at tdpixi.dannydannydanny.me.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 nixos/hosts/phantom-ship.nix | 29 ++++++++++++++++++++++++++---
 nixos/hosts/vps-relay.nix    |  4 ++++
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/nixos/hosts/phantom-ship.nix b/nixos/hosts/phantom-ship.nix
index e018a73..99bec0e 100644
--- a/nixos/hosts/phantom-ship.nix
+++ b/nixos/hosts/phantom-ship.nix
@@ -50,11 +50,11 @@ in
 
   # KomTolk (:8080), Shelfish (:8081), Scuttle (:8082), Bananasimulator
   # (:8083), Forgejo (:3000), Escape Hormuz (:8090), bon (:8091),
-  # notes (:8092) are reachable only over the ZeroTier mesh — the
-  # vps-relay Caddy reverse-proxies into them. Same pattern as
+  # notes (:8092), TDPixi (:8093) are reachable only over the ZeroTier mesh —
+  # the vps-relay Caddy reverse-proxies into them. Same pattern as
   # sunken-ship's bbbot. Not in global allowedTCPPorts, so the WAN side
   # stays closed.
-  networking.firewall.interfaces."zt+".allowedTCPPorts = [ 3000 8080 8081 8082 8083 8090 8091 8092 ];
+  networking.firewall.interfaces."zt+".allowedTCPPorts = [ 3000 8080 8081 8082 8083 8090 8091 8092 8093 ];
 
   hardware.enableRedistributableFirmware = true;  # iwlwifi (Intel 8260) + GPU + BT firmware
 
@@ -527,6 +527,29 @@ in
     };
   };
 
+  # TDPixi — Idle Tower Defence Telegram Mini App by @plasmagoat.
+  # Pure static serve, no DB. Code rsync'd to /home/danny/tdpixi/.
+  # Upstream: https://github.com/plasmagoat/TDPixi
+  systemd.services.tdpixi = let
+    pythonEnv = pkgs.python3.withPackages (ps: with ps; [
+      fastapi
+      uvicorn
+    ]);
+  in {
+    description = "tdpixi — Idle Tower Defence Mini App";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    path = [ pythonEnv ];
+    serviceConfig = {
+      WorkingDirectory = "/home/danny/tdpixi";
+      ExecStart = "${pythonEnv}/bin/python -m uvicorn server:app --host :: --port 8093";
+      Restart = "on-failure";
+      RestartSec = 10;
+      User = "danny";
+    };
+  };
+
   # Hara morning heartbeat — daily email check + Telegram good-morning ping.
   # Runs claude in print mode with the Gmail MCP, then sends output via Bot API.
   # Token lives in ~/.claude/channels/telegram/.env (managed by the telegram plugin).
diff --git a/nixos/hosts/vps-relay.nix b/nixos/hosts/vps-relay.nix
index 3387aa5..207e8b8 100644
--- a/nixos/hosts/vps-relay.nix
+++ b/nixos/hosts/vps-relay.nix
@@ -142,6 +142,10 @@
       "bon.dannydannydanny.me".extraConfig = ''
         reverse_proxy http://[fdd5:53a2:de33:d269:6499:936c:48a:bbdc]:8091
       '';
+      # TDPixi — Idle Tower Defence Mini App by @plasmagoat, port 8093.
+      "tdpixi.dannydannydanny.me".extraConfig = ''
+        reverse_proxy http://[fdd5:53a2:de33:d269:6499:936c:48a:bbdc]:8093
+      '';
       # notes — markdown blog (notes.X) + apex landing (X). Same backend
       # service on phantom :8092 routes by Host header.
       "notes.dannydannydanny.me".extraConfig = ''