Add gcalcli OAuth consent pages

hosts/heather/caddy.nix

@@ -106,6 +106,14 @@ Allow: /" 200
         reverse_proxy 127.0.0.1:3002
       '';
 
+      # Public OAuth consent pages for the personal gcalcli application.
+      "gcalcli.iscg.dev".extraConfig = ''
+        root * /etc/gcalcli-site
+        try_files {path} {path}.html
+        file_server
+        encode zstd gzip
+      '';
+
       # paseo daemon endpoint для desktop/mobile-клиентов.
       # Basic Auth здесь намеренно нет: мобильный клиент Paseo его не умеет.
       # Доступ защищён встроенным PASEO_PASSWORD самого демона.

hosts/heather/default.nix

@@ -45,6 +45,14 @@
     python3
   ];
 
+  # Static public pages used by the personal gcalcli OAuth application.
+  environment.etc = {
+    "gcalcli-site/index.html".source = ./gcalcli-site/index.html;
+    "gcalcli-site/privacy.html".source = ./gcalcli-site/privacy.html;
+    "gcalcli-site/terms.html".source = ./gcalcli-site/terms.html;
+    "gcalcli-site/style.css".source = ./gcalcli-site/style.css;
+  };
+
   # Docker requires forwarding; AstrNet ingress is blocked by astrnet-guard.
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
 

hosts/heather/gcalcli-site/index.html

@@ -0,0 +1,23 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>gcalcli — personal calendar tool</title>
+  <meta name="description" content="A small personal tool for managing Google Calendar from the command line.">
+  <link rel="stylesheet" href="/style.css">
+</head>
+<body>
+  <main>
+    <p class="eyebrow">gcalcli · personal utility</p>
+    <h1>Google Calendar, without the ceremony.</h1>
+    <p class="lead">This OAuth application is a private, local tool used by its owner to read and edit events in Google Calendar through <a href="https://github.com/insanum/gcalcli">gcalcli</a>.</p>
+    <nav aria-label="Site navigation">
+      <a href="/privacy">Privacy policy</a>
+      <a href="/terms">Terms of service</a>
+    </nav>
+    <p class="meta">This is not a public service. It does not offer accounts, subscriptions, or access for other users.</p>
+    <footer>Contact: <a href="mailto:unprovableaxiom@gmail.com">unprovableaxiom@gmail.com</a></footer>
+  </main>
+</body>
+</html>

hosts/heather/gcalcli-site/privacy.html

@@ -0,0 +1,28 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Privacy policy — gcalcli</title>
+  <link rel="stylesheet" href="/style.css">
+</head>
+<body>
+  <main>
+    <p class="eyebrow">gcalcli</p>
+    <h1>Privacy policy</h1>
+    <p>This application is a private personal tool used by one person to manage their own Google Calendar.</p>
+    <h2>What data is accessed</h2>
+    <p>With the owner’s permission, the application can access Google Calendar data needed to list, create, update, and delete calendar events.</p>
+    <h2>How data is used</h2>
+    <p>Calendar data is used only for the owner’s calendar management. It is not sold, rented, published, or shared with third parties by this application. The application does not use calendar data for advertising or profiling.</p>
+    <h2>Storage and security</h2>
+    <p>OAuth credentials are stored locally on the owner’s computer. This website does not collect or store calendar events, Google passwords, or OAuth tokens.</p>
+    <h2>Revoking access</h2>
+    <p>The owner can revoke access at any time from their <a href="https://myaccount.google.com/connections">Google Account connections</a> page.</p>
+    <h2>Contact</h2>
+    <p>Questions can be sent to <a href="mailto:unprovableaxiom@gmail.com">unprovableaxiom@gmail.com</a>.</p>
+    <nav aria-label="Site navigation"><a href="/">Home</a><a href="/terms">Terms of service</a></nav>
+    <footer>Last updated: 5 October 2026</footer>
+  </main>
+</body>
+</html>

hosts/heather/gcalcli-site/style.css

@@ -0,0 +1,48 @@
+:root {
+  color-scheme: light;
+  --ink: #1d1d1f;
+  --muted: #6d6d72;
+  --line: #dededb;
+  --paper: #f7f7f4;
+  --accent: #315c8a;
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  background: var(--paper);
+  color: var(--ink);
+  font: 16px/1.65 system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+}
+
+main {
+  width: min(720px, calc(100% - 40px));
+  margin: 0 auto;
+  padding: 12vh 0 10vh;
+}
+
+.eyebrow {
+  margin: 0 0 1.5rem;
+  color: var(--muted);
+  font-size: .78rem;
+  font-weight: 650;
+  letter-spacing: .14em;
+  text-transform: uppercase;
+}
+
+h1, h2 { line-height: 1.15; letter-spacing: -.025em; }
+h1 { max-width: 620px; margin: 0 0 1.5rem; font-size: clamp(2.4rem, 7vw, 5rem); }
+h2 { margin: 2.8rem 0 .8rem; font-size: 1.35rem; }
+p { max-width: 60ch; margin: 0 0 1.1rem; }
+.lead { max-width: 600px; color: #454549; font-size: 1.18rem; }
+
+nav { display: flex; flex-wrap: wrap; gap: 1.1rem; margin-top: 3rem; padding-top: 1rem; border-top: 1px solid var(--line); }
+a { color: var(--accent); text-underline-offset: 3px; }
+nav a { text-decoration: none; }
+nav a:hover { text-decoration: underline; }
+
+.meta { margin-top: 4rem; color: var(--muted); font-size: .9rem; }
+ul { padding-left: 1.3rem; }
+footer { margin-top: 4rem; color: var(--muted); font-size: .9rem; }
+@media (max-width: 520px) { main { padding-top: 8vh; } }

hosts/heather/gcalcli-site/terms.html

@@ -0,0 +1,24 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Terms of service — gcalcli</title>
+  <link rel="stylesheet" href="/style.css">
+</head>
+<body>
+  <main>
+    <p class="eyebrow">gcalcli</p>
+    <h1>Terms of service</h1>
+    <p>This application is a private personal utility for its owner. It is not offered as a public hosted service and does not create user accounts or charge fees.</p>
+    <h2>Use of the application</h2>
+    <p>The application is provided for the owner’s personal calendar management. The owner is responsible for reviewing changes before they are made and for maintaining access to their Google account.</p>
+    <h2>Availability</h2>
+    <p>The application is provided as-is, without guarantees of availability, accuracy, or suitability for a particular purpose. Google Calendar remains the source of truth for calendar data.</p>
+    <h2>Contact</h2>
+    <p>Questions can be sent to <a href="mailto:unprovableaxiom@gmail.com">unprovableaxiom@gmail.com</a>.</p>
+    <nav aria-label="Site navigation"><a href="/">Home</a><a href="/privacy">Privacy policy</a></nav>
+    <footer>Last updated: 5 October 2026</footer>
+  </main>
+</body>
+</html>