miniflux: move into module

nixos/gorgon/configuration.nix

@@ -71,15 +71,6 @@ in
     ];
   };
 
-  services.miniflux = {
-    enable = true;
-    config = {
-      CLEANUP_FREQUENCY = "48";
-      LISTEN_ADDR = "localhost:8080";
-    };
-    adminCredentialsFile = "/var/lib/miniflux/admin-credentials";
-  };
-
   environment.systemPackages = with pkgs; [
     chromium
     ghostscript

nixos/modules/default.nix

@@ -10,6 +10,7 @@
   headphones = import ./headphones.nix;
   homepage = import ./homepage.nix;
   kanboard = import ./kanboard;
+  miniflux = import ./miniflux.nix;
   networking = import ./networking.nix;
   nix = import ./nix.nix;
   nixpkgs = import ./nixpkgs.nix;

nixos/modules/miniflux.nix

@@ -0,0 +1,39 @@
+{ config, lib, ... }:
+let
+  cfg = config.dadada.miniflux;
+  domain = "miniflux.${config.networking.domain}";
+  adminCredentialsFile = "miniflux-admin-credentials";
+in
+{
+
+  options.dadada.miniflux = {
+    enable = lib.mkEnableOption "Enable miniflux RSS aggregator";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.miniflux = {
+      enable = true;
+      config = {
+        CLEANUP_FREQUENCY = "48";
+        LISTEN_ADDR = "localhost:8080";
+      };
+      adminCredentialsFile = config.age.secrets.${adminCredentialsFile}.path;
+    };
+
+    services.nginx.virtualHosts.${domain} = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations."/".extraConfig = ''
+        proxy_pass http://localhost:8080/;
+      '';
+    };
+
+    age.secrets.${adminCredentialsFile} = {
+      file = "${config.dadada.secrets.path}/${adminCredentialsFile}.age";
+      owner = config.systemd.services.miniflux.serviceConfig.User;
+      group = "root";
+      mode = "0700";
+    };
+  };
+}

nixos/modules/profiles/base.nix

@@ -0,0 +1,7 @@
+{ config, ... }:
+{
+  security.acme = {
+    defaults.email = "d553a78d-0349-48db-9c20-5b27af3a1dfc@dadada.li";
+    acceptTerms = true;
+  };
+}

nixos/modules/profiles/laptop.nix

@@ -6,6 +6,7 @@
 with lib; {
   imports = [
     ./backup.nix
+    ./base.nix
   ];
 
   networking.domain = mkDefault "dadada.li";

nixos/modules/profiles/server.nix

@@ -6,6 +6,7 @@
 with lib; {
   imports = [
     ./backup.nix
+    ./base.nix
   ];
 
   networking.domain = mkDefault "dadada.li";

nixos/surgat/configuration.nix

@@ -41,6 +41,7 @@ in
 
   dadada.element.enable = true;
   dadada.gitea.enable = true;
+  dadada.miniflux.enable = true;
   dadada.weechat.enable = true;
   dadada.homePage.enable = true;
   dadada.share.enable = true;
@@ -65,11 +66,6 @@ in
     ];
   };
 
-  security.acme = {
-    defaults.email = "d553a78d-0349-48db-9c20-5b27af3a1dfc@dadada.li";
-    acceptTerms = true;
-  };
-
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;

secrets/gorgon-backup-passphrase.age

@@ -1,10 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 0aOabg MxtQYFyYyErJW0Uaelu02iRAoksaVDsZD+55ADoNphE
-pA0OKXbqXrNWwbc52exj22cbMsFVCjk6hwp7KeWYyyA
--> ssh-ed25519 Otklkw c/v7Ux1D4FtdIa0fzoEkGJSH+/bexN1nJUfLg1Ym7lA
-Bi1cIh9wjppaBSpTLh7HdpJX+ZcGOLDjxaDUJXbJ6+I
--> s2,Qn0%_-grease pZM*A 1(
-4W6WjHNho1bIzpd+IFh6fHQgo+3d5FK+RO5TOZw+T6A211bvOCoHG0LBZfpohqKy
-Q6zFhrMxOtWTne8uvX5hm9yXV2+cd6EbxOuk
---- ZFD001UDd7ZmLNT8tG8ecnVIF0UgW0YQhh15dgUjVJI
-XéËÝÁã©-KÕA—üsß¿Î,u-KYo¨ëÚHóÍV$Ba¨¢…à·ú^…À]Kã:UMfwß;+7.#ÑJ^'æ W–
GÅ
Fø
+-> ssh-ed25519 0aOabg 9925sO5KCINg9I0lFyD7I83Q/inYVtVvtzskAo0UnW4
+7WrwhYtGh4tGV1MOMN5Ok/1xqOy0mek2SOjC3gQvPOI
+-> ssh-ed25519 Otklkw l+H64LT7yh+tXhBqxkI+C+U6/6boKV41YVay2cGLNX8
+nCsvh1IIFiQDeNjdkurHwxT0VEZt8yBkvQoYKacZB7g
+-> SZr0-grease
+AVV51s2iYes+DKhlYlNDzaXs7BPXaqwzjJLzMapEK31iuOs7mRKK
+--- NlKhbaqBp78g2+PLSHhm4RE2CT40JFxEIpQCrNwAtsI
+ôCÞŽø ðè‚urY—#Êç(ËþC  Ä{$q2{0;<kà×R¹(ïùÔ“{ÖŒÜRÒ³›OŸ¥Hç}%G·}
+áZ„d‘=…=Ú»

secrets/miniflux-admin-credentials.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 jUOjpw HIvtQ2CaS+Ptl06tKVCwMzoi4UZm0GcNO+dJJjGZm3g
+JZ68fxpbY55B2xMG+QG3yNYMMQgBxtTVMtHoXOqUlrQ
+-> ssh-ed25519 Otklkw kUySbDgMFgWVEwL7rXs15FDISicEMH06qXIxudO/2jY
+VbVX2/4wYojcWm/GKnZAP3uxQygcm6BcNO+iphqIos8
+-> o>]-grease d%oS;Ov l
+
+--- /LWxjPTlr/au9B1Kn6+apBZnTROxCqs8WKmtPINbDko
+t/0‡
Ðc®ì—<C3AC>Ü#N<>þãߦäé@Íù¶±<C2B6>\ß3åi,5²á3Avæ¶<16>mrœw*ÒµÒ;þ«$•¥áŸtƒaåä¤î£‰îMg®éñƵaæÉô

secrets/pruflas-backup-passphrase.age

@@ -1,9 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 IXCPDQ VpRlsUErxZEZErq6I00VT68UmldZxwvNUNThtyHk018
-P73fCgVg9K9ZFdvl3Zrmm1GGcTlDLi5mfsEcHxCbcJk
--> ssh-ed25519 Otklkw p06KPkqvFXvB07/yXkZmSzmzZASA2IJpNCY3hKqnUVo
-e6O2NH4KVtqPQfew4++pprbcHANsvemybeqB9SEhEYI
--> q%f1-grease dRH3(# Y)tQV [: \xNgmi4+
-QKbFPHhDVSUTqidH0FrlhCMqoKT/ySgPXSAMVEQYVl3aQbBvX6/4nUac
---- 8bt7MoQ9fprGESqngxXUiOdQvCdssgoiF4rUKj6BeS4
-󋃂q·ivý
‹Šûµ•ø½U<C2BD>uÉÏ5û–Ë°®Ñ¢+û„nú¹lj¤Ç2x•49žïÆ!0ÎO~%t
+-> ssh-ed25519 IXCPDQ VbUG0IRip4izfPy6N+F2pqf6x4I+1sNCHBoXIFkeDgc
+6GpwDE1gyZ0ZY1xwxXevfaKbBgxf3ejl5u7tAQy1po8
+-> ssh-ed25519 Otklkw Z5ijymE5Hxf5swuOk3ZMDnnCY58AJDW72Xvtm6PNSRQ
+WfNQD1CQFjddq2HVFzVucYMggZpMFLFrIGhL5iVHFFU
+-> 81Dzfax-grease zDYB
+O0b1HCDGNbuzc8FB0dmmWCGsKn+XaJ0Evs6Fk/fUqnznZ3q0X5ROyNNvMaLhuW3c
+V/q2AhaXNAnTpTr8/v+e
+--- kkf90OQdUMEyJPyQNOVoQauX3RceUvD6eawbr4rYrow
+ŕîQ|ˇ®wWŻVŘ Gą+*X¶['ÁD‘ń ććŔóPˇWˇ3RX¦€=°SňŁIE©ř	ŞÂňľÓP
U

secrets/pruflas-wg-hydra-key.age

@@ -1,9 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 IXCPDQ FRY6uw3eRrqUYZcnick1yxcSyEHuWkM6TMkOWPFuq0I
-GLZMQFHoi4eJfbxz8kqECoj7ju0+scyNgWyILwGuJGw
--> ssh-ed25519 Otklkw nznkiropYOdg3MMMEXmRn7GKkb4GycoNtKqsWwhGF3Q
-77AEvdNpqQrppOm4ZQJAM4WPXtE+ekAufBSAMBO9oYY
--> 26-grease Z Sz rY0V d\j0aR[
-f+yb
---- fluVV/qz+D6+MaIbIvzWCDWEhWHjC1TmgsD4FweilGQ
-³µ"ƒSá-‚àÑp&‚àY“HfS»HêU9(Áï}æd°n‡øcU$/<2F>Éy&œU0v±Ð##!Æ=ñ©­ÿ·<C3BF>üIÍaád°	l¶
+-> ssh-ed25519 IXCPDQ uawIdwF9OtTw/T+fxwxkqdCRq64HL1UeMQnWK0u+Z3g
+zEKpu/bdSapYM0piNoqiLNuUit1exx6ZIiXmsEDX8CE
+-> ssh-ed25519 Otklkw ilkLObEIp+/4VfZM8Xt927xh6ZF/dBF+PInbyi6RZC4
+9t65163vGEnbApN4OQ639JNLrwEQHDH0nikou3jHlnc
+-> 0FJN$-grease X!M kI~E|gX
+mGoZVxbAOLq5LXGj9hPjMNLJxUZK4jpYa/wsyiVgkxTm09AUN3tmlYFjhDClpRfT
+Id1zRQ1+
+--- slPVZ1Tqz9Vr2drSyuTarmm0Et9FvjAjsXvR2DSGRPk
+ﾏE慣ﾖﾂ霧┌;1舮ﾓ<E888AE>綿掩政叉煆絆ｾﾞ <20>j@j<>哂ﾔ6誚9ﾜｷ0<EFBDB7>ｯﾗu炭ｬWh檄\yjﾘ<6A>ﾖ`#

secrets/pruflas-wg0-key.age

@@ -1,9 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 IXCPDQ yZsU7q89HVxP6Ldup2noEaGy5+SzFzuMtA4/+4mQfUU
-w1cM4NXL+M9RjRjuYswEWYhtiWPgjlJEdwm9wQ9GF5Q
--> ssh-ed25519 Otklkw O8jQnBDmaBnKLHU4nAIeRwkXE3ovdw7Y6vmZcmwqpUc
-rM5wbfCSQhA0wxfRPVLB7dVl8L8aiB9eWhTX/ARV1YE
--> pJ-grease ~4C{og l_
-pXTBa1xB/KJU5w
---- +w4Zc/+fVRky0Nzu0R9cc1MKAOgig1swtCLDrb6M4WM
-ł_Í LJ
´îŽîŐďú˛pĆB„´űÓ$źŁfÓ’xťw}îAŐÎ6ޤ6°P˛Ć-{+öE±ţÜ[FßÖaýWś,ŘÂ…Žl¶­Ž&
+-> ssh-ed25519 IXCPDQ Qg6xQfJx/eBP+UkFRGoH/GJf4z8/DN4YVVZm58woLH4
+0VRw46oFMdPXyZZfuWSfWAwcprKKUj/O+8pURvrRdYg
+-> ssh-ed25519 Otklkw y0cWlk4UO1NmKfTOVJF4z6QcKO96sLnw3NuuCNEZzC4
+3bvuqHug5Rsi69tM1kUnEDIZjJLsbqKt9UsEsQ36Xg4
+-> /-grease 5B 9m!v/n_
+Ye655SZ1lLXBsz3ST95H7SqG3+CYNpiF/X5jm8BoTkATh25f6011oYyzfja8DI9V
+bDPP/4qtq1IaNtOarW4
+--- SF8+5srzcd3gzC0/pCC90QFIAyfX98B33/Vu6xAFVok
+8H<EFBFBD>ÞŠ3Ú˜:Žƒ?¹ßŽ"6Ì”hg‰ôhû‹-½Ðm¢§–4ÄŽÿXKÇ`"Ù3‡šmNY¿ ²õ'ÄlçÛ\µH¶‘«$¹E

secrets/pruflas-wg0-preshared-key.age

@@ -1,10 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 IXCPDQ Q0ETN6DFshfo+YouSf/YWX7u8otnnAqZr/Y7qxCRiTI
-5LVB4bzpysObZJkmJJw2kgE57lZKs2XA8BVSwS7y/VM
--> ssh-ed25519 Otklkw Lgo+x/ODCP6e3SHg2rZVNNLZkHCCT7YMC7MT0Fa4dHc
-bX+Bja0SeGBzNQS3vUGj+GVDAYVTgyGQtPw5I0DWPdU
--> 7&'U\;\-grease ot 7f'PU3CA
-O2UHtKXSTN5TrfVh7ROQ8x9YLynOFvrxK+1kSW42hGbTstOdhBAlNfKMdiIM4Itn
-k7Jshx6UTqa8dF8QIw2cme0jFkF8JUioj7uQuusGBG/WZg
---- Wau438nNnP4srJ16gRGC/9jUdCB6TjBgxc2kZVRsvn0
-´fŰ<>đŻm7¬şöŰă\űĐVÚÚhđ
ęĄëMeömľ^ő?EkfPű7ÔÄhĄôäu]ÝnĹ+n.>†É<dOńˇ|Çn_k&»ÄĘo
+-> ssh-ed25519 IXCPDQ 26Tx0J994O7tNFH/Du/0+aXIm2Piv/E3XR+3S6zi53E
+/gQsKKxvXxGZ3Ij2SDlDwVQ7l+dP49OSXjGksd4jxs4
+-> ssh-ed25519 Otklkw TDSrNWf7714IaGoiCWVeUkzRvlL5GY6jPXdRFTEVkQY
+IXWZf+V/3l1Z96pkepS7e26YAGxA5tXczBT19Ate0Qc
+-> B2G_Mqi-grease C(c0D U|eF%E NI[cL Hcv>G;E;
+tn4gxjXc36nwxhH/+27mr75yL/bEMtrzycrNseEDBa/spBI0zKX6Kaqvo002kJ0O
+ZoBuqZtD0C7aSFuJnThgvEdoezY4+poRGc7qs9eM
+--- 5nN5k3/r28YT65sq5yG32gU/l9C0Edq1LeBt+DTWvOY
+–¬h0uò&bÇÃýÝ…’ÃÝâ®4™iâpé¹q¦&A(ü¤Y†ËQ~L»ŽÜ»ÄÊ'•EÎ’#)
+O³å[}­ÑIÜ O@Ü

secrets/secrets.nix

@@ -17,6 +17,7 @@ in
   "pruflas-wg0-preshared-key.age".publicKeys = [ systems.pruflas dadada ];
   "pruflas-wg-hydra-key.age".publicKeys = [ systems.pruflas dadada ];
   "hydra-github-authorization.age".publicKeys = [ systems.pruflas dadada ];
+  "miniflux-admin-credentials.age".publicKeys = [ systems.surgat dadada ];
 } //
 backupSecrets "gorgon" //
 backupSecrets "ifrit" //

secrets/surgat-backup-passphrase.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 jUOjpw ikxbgvfWvYiUFTLNy5xUrKC8s1kgan3QIrETluUkmGU
-Y5LQz7aPC4g88U0MkVAoir5CKWpekwJEVZJwdDfW4wk
--> ssh-ed25519 Otklkw QBxsdqftDsU5+DEPH0zj3WSidosaoA6IepyNK+zw/mc
-fbf7lsPi+AIcRBWwe82ZUlmXHsEbN58iV6/jjk7XIcQ
--> qY<-grease A zw lCw
-FJORgHmIMl1Lz71zMvlrCcSTfGb5QEwl6gv0Z3tMurt6gIGiXIs
---- DmTEAWa//clLZyqQlAF9mi7ypBdmhsNC/h9ptJc8m2I
-<14><><EFBFBD><EFBFBD>|1<> <20>͝<EFBFBD><CD9D><EFBFBD><EFBFBD><EFBFBD>%<25>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><1E><>qyŝ<79>"P<><50>Z<EFBFBD>Ķ[-깄<08><>_]<5D>y<EFBFBD> <20>(Y<><59><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+-> ssh-ed25519 jUOjpw u4ifSfdgxQsYbHtedN+O6YYvTAcOfNgUdI9k6GwJ424
+iFE/eNTbfRhDvAZhfbEcqE8HwgWaaymw4SvoMDdjoCo
+-> ssh-ed25519 Otklkw NSp+/vP+bTKUBhuqOO8+0fSpVZWybLCj55BXcKXcsCo
+4nsPRCiW7jsPxdONrfYc+2Nn7IshzIanAJx8z7hGCCU
+-> %)-grease ER#$<QL4 !~[9 l4,_m }h=MMO)
+6JuxshAlOYFuEaXuj/ZA7A
+--- M/x38c2rkmqMXlrA6/9yB1quYVKI/2nqCNGf7hR0Mlw
+àáN|#¶*<2A>ƒà
<01>ÆWÏKM1?fÖ8 :
Ví8]*îñÎÓ_—b{´%Å4ï)½ìY#„…%<25>?<3F>Q_