]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/miniflux.nix
creds: finish to migrate to systemd-creds.nix
[sourcephile-nix.git] / hosts / mermet / miniflux.nix
1 { pkgs, lib, config, inputs, hostName, ... }:
2 let
3 inherit (config.networking) domain;
4 inherit (config.services) nginx postgresql;
5 inherit (config.users) users groups;
6 srv = "miniflux";
7 in
8 {
9 systemd.sockets.miniflux = {
10 listenStreams = [ "/run/miniflux.sock" ];
11 wantedBy = [ "sockets.target" ];
12 socketConfig.SocketMode = "600";
13 socketConfig.SocketUser = nginx.user;
14 };
15 services.miniflux = {
16 enable = true;
17 config = {
18 BASE_URL = "https://${srv}.${domain}"; # Base URL to generate HTML links and base path for cookies.
19 BATCH_SIZE = "3"; # Number of feeds to send to the queue for each interval.
20 CLEANUP_ARCHIVE_UNREAD_DAYS = "60";
21 CLEANUP_ARCHIVE_READ_DAYS = "30";
22 #DEBUG = "on";
23 LISTEN_ADDR = "";
24 #METRICS_COLLECTOR = "1";
25 POLLING_FREQUENCY = "180";
26 POLLING_SCHEDULER = "entry_frequency";
27 SCHEDULER_ENTRY_FREQUENCY_MAX_INTERVAL = "10080"; # 7*24*60 = 7d
28 WATCHDOG = "1";
29 WORKER_POOL_SIZE = "2";
30 };
31 adminCredentialsFile = "/run/credentials/miniflux.service/credentials";
32 };
33 systemd.services.miniflux = {
34 partOf = [ "postgresql.service" ];
35 # For the socket-activation
36 wantedBy = lib.mkForce [ ];
37 unitConfig = {
38 RefuseManualStart = true;
39 };
40 serviceConfig = {
41 LoadCredentialEncrypted = [
42 "credentials:${inputs.self}/hosts/${hostName}/miniflux/credentials.cred"
43 ];
44 # For postgres auth
45 User = users."miniflux".name;
46 Group = groups."postgres".name;
47 # For the confinement
48 BindReadOnlyPaths = [
49 "/run/systemd/journal/socket"
50 "/run/postgresql"
51 "/etc/pki/tls/certs/ca-bundle.crt"
52 "/etc/hosts"
53 ];
54 Type = "notify";
55 DynamicUser = lib.mkForce false;
56 UMask = lib.mkForce "0022";
57 # For the hardening
58 NoNewPrivileges = true;
59 PrivateTmp = true;
60 RemoveIPC = true;
61 #ProtectSystem = true;
62 };
63 confinement = {
64 enable = true;
65 binSh = null;
66 mode = "chroot-only";
67 };
68 };
69 services.postgresql.identMap = ''
70 # MAPNAME SYSTEM-USERNAME PG-USERNAME
71 user ${users.miniflux.name} ${users.miniflux.name}
72 '';
73 users.users."miniflux" = {
74 isSystemUser = true;
75 group = groups."postgres".name;
76 };
77 services.nginx.virtualHosts."${srv}.${domain}" = {
78 forceSSL = true;
79 useACMEHost = domain;
80 extraConfig = ''
81 access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
82 error_log /var/log/nginx/${domain}/${srv}/error.log warn;
83 '';
84 locations."/" = {
85 proxyPass = "http://unix:/run/miniflux.sock:/";
86 };
87 };
88 systemd.services.nginx.serviceConfig.LogsDirectory =
89 lib.mkForce ["nginx/${domain}/${srv}"];
90 }