orion: enable sift P1 (pin fac1462)

Add the sift flake input at fac1462e7b3deb2082c9f6ae8dc4676fddf8d089
(git+ssh; git+https cannot auth on orion) and enable services.sift on
orion: loopback :8890, tailscale serve :8443 from the module, static
home WAN /32 in denyPrefixes. Keys stay on-box.

flake.lock

@@ -392,6 +392,7 @@
         "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "sgard": "sgard",
+        "sift": "sift",
         "tracker": "tracker"
       }
     },
@@ -437,6 +438,27 @@
         "type": "github"
       }
     },
+    "sift": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790140288,
+        "narHash": "sha256-ZOOKd5X96G5qCDkAZepuOWJ+vyiIHvx6QY+iX0itom0=",
+        "ref": "refs/heads/master",
+        "rev": "fac1462e7b3deb2082c9f6ae8dc4676fddf8d089",
+        "revCount": 12,
+        "type": "git",
+        "url": "ssh://git@git.wntrmute.dev/kyle/sift"
+      },
+      "original": {
+        "rev": "fac1462e7b3deb2082c9f6ae8dc4676fddf8d089",
+        "type": "git",
+        "url": "ssh://git@git.wntrmute.dev/kyle/sift"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,

flake.nix

@@ -23,6 +23,9 @@
     tracker.url = "git+https://git.wntrmute.dev/kyle/tracker";
     tracker.inputs.nixpkgs.follows = "nixpkgs";
 
+    sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=fac1462e7b3deb2082c9f6ae8dc4676fddf8d089";
+    sift.inputs.nixpkgs.follows = "nixpkgs";
+
     lector.url = "github:kisom/lector";
     lector.inputs.nixpkgs.follows = "nixpkgs";
 

hw/orion/default.nix

@@ -1,10 +1,11 @@
-{ pkgs, ... }:
+{ pkgs, inputs, ... }:
 {
   imports = [
     ./hardware-configuration.nix
     # orion started as a desktop with an interactive installer;
     # the disk is already provisioned.
     # ./disk-config.nix
+    inputs.sift.nixosModules.sift
   ];
 
   config = {
@@ -75,5 +76,11 @@
         ExecStart = "${pkgs.tailscale}/bin/tailscale serve --bg --yes 8888";
       };
     };
+
+    services.sift = {
+      enable = true;
+      listen = "127.0.0.1:8890";
+      denyPrefixes = [ "99.73.161.224/32" ];
+    };
   };
 }