NixOS module for serving Emanote site behind Github login

[srid]

A NixOS module that uses nginx and oauth2 proxy to serve the Emanote site off a private Git repo, using emanote run --no-ws, while allowing only that repository collaborators to view the site.

This enables sharing a private notebook for both editing and viewing to set of GitHub users.

Github Pages does it support this, but it will require an organization with an enterprise plan, which is not feasible for personal use.

[srid]

Stretch goal: it should automatically git pull behind the scenes; ideally doing it in response to commit push webhook notification, rather than polling.