nixedo: re-add FreshRSS

Signed-off-by: Oliver Davies <oliver@oliverdavies.uk>

hosts/nixedo/homelab.nix

@@ -10,6 +10,7 @@
       audiobookshelf.enable = true;
       home-assistant.enable = true;
       homepage-dashboard.enable = true;
+      freshrss.enable = true;
       paperless.enable = true;
       peertube.enable = true;
       tubearchivist.enable = true;

hosts/nixedo/modules/acme.nix

@@ -26,6 +26,7 @@
                 "code"
                 "eric"
                 "florida-drupalcamp-tailwind-css"
+                "freshrss"
                 "home"
                 "jellyfin"
                 "luke"

hosts/nixedo/modules/default.nix

@@ -23,6 +23,7 @@ with lib;
     ./cloudflared.nix
     ./containers
     ./forgejo.nix
+    ./freshrss.nix
     ./home-assistant.nix
     ./immich.nix
     ./jellyfin.nix

hosts/nixedo/modules/freshrss.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
+
+  cfg = homelab.services.${service};
+  homelab = config.homelab;
+  service = "freshrss";
+in
+{
+  options.homelab.services.${service} = {
+    enable = mkEnableOption "Enable ${service}";
+
+    url = mkOption {
+      default = "freshrss.${homelab.domain}";
+      type = types.str;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services = {
+      ${service} = {
+        enable = true;
+
+        baseUrl = "https://${cfg.url}";
+        passwordFile = config.age.secrets.freshrss-password-file.path;
+        virtualHost = cfg.url;
+      };
+
+      nginx.virtualHosts.${cfg.url} = {
+        useACMEHost = homelab.domain;
+        forceSSL = true;
+      };
+    };
+  };
+}

hosts/nixedo/secrets.nix

@@ -2,5 +2,6 @@
   age.secrets = {
     cloudflare.file = ../../secrets/cloudflare.age;
     cloudflared.file = ../../secrets/cloudflared-credentials.age;
+    freshrss-password-file.file = ../../secrets/freshrss-password-file.age;
   };
 }

secrets.nix

@@ -25,6 +25,11 @@ in
   ]
   ++ [ users.opdavies ];
 
+  "secrets/freshrss-password-file.age".publicKeys = [
+    hosts.nixedo
+  ]
+  ++ [ users.opdavies ];
+
   "secrets/peertube-env.age".publicKeys = [
     hosts.nixedo
   ]

secrets/freshrss-password-file.age

@@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-ed25519 IsVD3g qUcQuqnQVqFEa3pMKA4MCAGvBdkU55wUc9QL+CV7bEg
+xFsrPc+7aZBg4AQscuf4uI+NkjHW+iDtx9+lIFGhwvM
+-> ssh-rsa +vTWQw
+ZsahI21WKpNepuhJFCxRLJmfJaY8ZarIlLXTyhEzPwZ8OISpHfJ4gkgk42AMFZrq
+s+Pr1zYx74EZ/VhfuxkvLCTekhW5aT9fk+NsGOZwuddywTjkgoKg8JzaMTXcTJxp
+uFYNfGlIUgn94SrnisJP/sNztdjluGz4fEhBo99WJb6KabHtWLllUwEkzwDeKbT4
+hFvCp3ZupjHi/8bb2faAu5CJ82C1bAuHGqhlgJvhdFgi+VMinGl9zUYkQNY12O+O
+z8zo5KxtNofzhkM3+Z8Xcnz1C5VaZNHtzvIDXVwA7CTuhc0H1a5uEN8keqBhN0dR
+YdU4WiINZcDBq0+A6Aou+TxBZE+IQ+hLQJVuZMch6oBznP6IigD3ugbrVoQtzDGf
+mdw87IXFB/tDMMSaT567XJoN7hECoZVqVc6pZKZgGZpmsScBpJBBAqSo6TLpzbsy
+/u5AhuiWBZZylaJlX6OrNAwobAbs07scJyufdEJ48ga8dVQI0OHiBphJbq92nGKt
+iBHW6nzjgfb4fe93LXaSAT66ffM3j5DOTx6DUkMZnHg0OqUIikWwRLBrLs1bC2oL
+1YXJICCbRdA0cW1DnTGtsjBTYwv3IKk3jvYD6XEJYpBXKJC8Uqx3pV/dxuwFrrLV
+Rk9U+RmwKmJasqiYFHuYJhEdPbxWT4YPgDwcHpD3vA4
+--- kD476dnm+Q4VMK9oHU4wIz6JciDtOS7LKik6Q2JgDdA
+˜Õb'H±n±?w°²ë@½—D-7Ê‚F"Aj üxU<1D>â{4dšâò6âý¥¹O¯P5