hosts/mermet/miniflux.nix

   1 { pkgs, lib, config, hostName, ... }:
   2 let
   3   inherit (config.networking) domain;
   4   inherit (config.security) gnupg;
   5   inherit (config.services) nginx postgresql;
   6   inherit (config.users) users groups;
   7   srv = "miniflux";
   8 in
   9 {
  10 systemd.sockets.miniflux = {
  11   listenStreams = [ "/run/miniflux.sock" ];
  12   wantedBy = [ "sockets.target" ];
  13   socketConfig.SocketMode = "600";
  14   socketConfig.SocketUser = nginx.user;
  15 };
  16 services.miniflux = {
  17   enable = true;
  18   config = {
  19     BASE_URL = "https://${srv}.${domain}"; # Base URL to generate HTML links and base path for cookies.
  20     BATCH_SIZE = "3"; # Number of feeds to send to the queue for each interval.
  21     CLEANUP_ARCHIVE_UNREAD_DAYS = "60";
  22     CLEANUP_ARCHIVE_READ_DAYS = "30";
  23     #DEBUG = "on";
  24     LISTEN_ADDR = "";
  25     #METRICS_COLLECTOR = "1";
  26     POLLING_FREQUENCY = "180";
  27     POLLING_SCHEDULER = "entry_frequency";
  28     SCHEDULER_ENTRY_FREQUENCY_MAX_INTERVAL = "10080"; # 7*24*60 = 7d
  29     WATCHDOG = "1";
  30     WORKER_POOL_SIZE = "2";
  31   };
  32   adminCredentialsFile = gnupg.secrets."miniflux/credentials".path;
  33 };
  34 security.gnupg.secrets."miniflux/credentials" = {};
  35 systemd.services.miniflux = {
  36   after = [ gnupg.secrets."miniflux/credentials".service ];
  37   wants = [ gnupg.secrets."miniflux/credentials".service ];
  38   # For the socket-activation
  39   wantedBy = lib.mkForce [ ];
  40   unitConfig = {
  41     RefuseManualStart = true;
  42   };
  43   serviceConfig = {
  44     # For postgres auth
  45     User = users."miniflux".name;
  46     Group = groups."postgres".name;
  47     # For the confinement
  48     BindReadOnlyPaths = [
  49       "/run/systemd/journal/socket"
  50       "/run/postgresql"
  51       "/etc/pki/tls/certs/ca-bundle.crt"
  52       "/etc/hosts"
  53     ];
  54     Type = "notify";
  55     DynamicUser = lib.mkForce false;
  56     UMask = lib.mkForce "0022";
  57     # For the hardening
  58     NoNewPrivileges = true;
  59     PrivateTmp = true;
  60     RemoveIPC = true;
  61     #ProtectSystem = true;
  62   };
  63   confinement = {
  64     enable = true;
  65     binSh = null;
  66     mode = "chroot-only";
  67   };
  68 };
  69 services.postgresql.identMap = ''
  70   # MAPNAME  SYSTEM-USERNAME         PG-USERNAME
  71   user       ${users.miniflux.name}  ${users.miniflux.name}
  72 '';
  73 users.users."miniflux" = {
  74   isSystemUser = true;
  75   group = groups."postgres".name;
  76 };
  77 services.nginx.virtualHosts."${srv}.${domain}" = {
  78   forceSSL = true;
  79   useACMEHost = domain;
  80   extraConfig = ''
  81     access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
  82     error_log  /var/log/nginx/${domain}/${srv}/error.log warn;
  83   '';
  84   locations."/" = {
  85     proxyPass = "http://unix:/run/miniflux.sock:/";
  86   };
  87 };
  88 systemd.services.nginx.serviceConfig.LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];
  89 }