]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/miniflux.nix
public-inbox: update
[sourcephile-nix.git] / hosts / mermet / miniflux.nix
1 { pkgs, lib, config, hostName, ... }:
2 let
3 inherit (config.networking) domain;
4 inherit (config.security) gnupg;
5 inherit (config.services) nginx postgresql;
6 inherit (config.users) users groups;
7 srv = "miniflux";
8 in
9 {
10 systemd.sockets.miniflux = {
11 listenStreams = [ "/run/miniflux.sock" ];
12 wantedBy = [ "sockets.target" ];
13 socketConfig.SocketMode = "600";
14 socketConfig.SocketUser = nginx.user;
15 };
16 services.miniflux = {
17 enable = true;
18 config = {
19 BASE_URL = "https://${srv}.${domain}"; # Base URL to generate HTML links and base path for cookies.
20 BATCH_SIZE = "3"; # Number of feeds to send to the queue for each interval.
21 CLEANUP_ARCHIVE_UNREAD_DAYS = "60";
22 CLEANUP_ARCHIVE_READ_DAYS = "30";
23 #DEBUG = "on";
24 LISTEN_ADDR = "";
25 #METRICS_COLLECTOR = "1";
26 POLLING_FREQUENCY = "180";
27 POLLING_SCHEDULER = "entry_frequency";
28 SCHEDULER_ENTRY_FREQUENCY_MAX_INTERVAL = "10080"; # 7*24*60 = 7d
29 WATCHDOG = "1";
30 WORKER_POOL_SIZE = "2";
31 };
32 adminCredentialsFile = gnupg.secrets."miniflux/credentials".path;
33 };
34 security.gnupg.secrets."miniflux/credentials" = {};
35 systemd.services.miniflux = {
36 after = [ gnupg.secrets."miniflux/credentials".service ];
37 wants = [ gnupg.secrets."miniflux/credentials".service ];
38 # For the socket-activation
39 wantedBy = lib.mkForce [ ];
40 unitConfig = {
41 RefuseManualStart = true;
42 };
43 serviceConfig = {
44 # For postgres auth
45 User = users."miniflux".name;
46 Group = groups."postgres".name;
47 # For the confinement
48 BindReadOnlyPaths = [
49 "/run/systemd/journal/socket"
50 "/run/postgresql"
51 "/etc/pki/tls/certs/ca-bundle.crt"
52 "/etc/hosts"
53 ];
54 Type = "notify";
55 DynamicUser = lib.mkForce false;
56 UMask = lib.mkForce "0022";
57 # For the hardening
58 NoNewPrivileges = true;
59 PrivateTmp = true;
60 RemoveIPC = true;
61 #ProtectSystem = true;
62 };
63 confinement = {
64 enable = true;
65 binSh = null;
66 mode = "chroot-only";
67 };
68 };
69 services.postgresql.identMap = ''
70 # MAPNAME SYSTEM-USERNAME PG-USERNAME
71 user ${users.miniflux.name} ${users.miniflux.name}
72 '';
73 users.users."miniflux" = {
74 isSystemUser = true;
75 group = groups."postgres".name;
76 };
77 services.nginx.virtualHosts."${srv}.${domain}" = {
78 forceSSL = true;
79 useACMEHost = domain;
80 extraConfig = ''
81 access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
82 error_log /var/log/nginx/${domain}/${srv}/error.log warn;
83 '';
84 locations."/" = {
85 proxyPass = "http://unix:/run/miniflux.sock:/";
86 };
87 };
88 systemd.services.nginx.serviceConfig.LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];
89 }