glance: Improve title of of per-host-sites-widgets

modules/nixos/services/caddy.nix

@@ -13,6 +13,12 @@ let
   publicHostsExist = virtualHosts |> lib.any (vHost: (!self.lib.isPrivateDomain vHost.domain));
   privateHostsExist = virtualHosts |> lib.any (vHost: self.lib.isPrivateDomain vHost.domain);
 
+  privateDomains =
+    virtualHosts
+    |> lib.filter (vHost: self.lib.isPrivateDomain vHost.domain)
+    |> lib.map (vHost: vHost.domain)
+    |> lib.unique;
+
   mkVirtualHost =
     {
       domain,
@@ -138,11 +144,7 @@ in
             reloadServices = [ "caddy.service" ];
           };
 
-          certs =
-            virtualHosts
-            |> lib.filter (host: self.lib.isPrivateDomain host.domain)
-            |> lib.map (host: lib.nameValuePair host.domain { })
-            |> lib.listToAttrs;
+          certs = privateDomains |> lib.map (domain: lib.nameValuePair domain { }) |> lib.listToAttrs;
         };
 
         services.nebula.networks.mesh.firewall.inbound = [
@@ -160,7 +162,11 @@ in
 
         systemd.services.caddy = {
           requires = [ netCfg.overlay.systemdUnit ];
-          after = [ netCfg.overlay.systemdUnit ];
+          wants = privateDomains |> lib.map (domain: "acme-${domain}.service");
+          after = [
+            netCfg.overlay.systemdUnit
+          ]
+          ++ (privateDomains |> lib.map (domain: "acme-${domain}.service"));
         };
 
         custom.persistence.directories = [ "/var/lib/acme" ];

modules/nixos/web-services/glance.nix

@@ -17,7 +17,7 @@ let
     |> lib.map (host: {
       type = "monitor";
       cache = "1m";
-      title = host.config.networking.hostName;
+      title = "${host.config.networking.hostName} Services";
       sites =
         host.config.custom.meta.sites
         |> lib.attrValues

modules/nixos/web-services/scrutiny.nix

@@ -34,7 +34,16 @@ in
       };
     };
 
-    systemd.services.scrutiny.enableStrictShellChecks = false;
+    systemd.services.scrutiny = {
+      enableStrictShellChecks = false;
+      serviceConfig = {
+        DynamicUser = lib.mkForce false;
+        ProtectSystem = "strict";
+        ProtectHome = "read-only";
+        PrivateTmp = true;
+        RemoveIPC = true;
+      };
+    };
 
     custom = {
       services.caddy.virtualHosts.${cfg.domain}.port = cfg.port;