From 0a6b9a92908f67dc0180d33696cc77c563fff9c0 Mon Sep 17 00:00:00 2001
From: Antoine Martin <antoine@alarsyo.net>
Date: Tue, 5 Dec 2023 13:59:21 +0100
Subject: [PATCH] services: setup microbin service

---
 hosts/hades/default.nix                    |   6 ++
 hosts/hades/secrets.nix                    |   2 +
 modules/secrets/microbin/secret-config.age | Bin 0 -> 522 bytes
 modules/secrets/secrets.nix                |   2 +
 services/default.nix                       |   1 +
 services/microbin.nix                      |  82 +++++++++++++++++++++
 6 files changed, 93 insertions(+)
 create mode 100644 modules/secrets/microbin/secret-config.age
 create mode 100644 services/microbin.nix

diff --git a/hosts/hades/default.nix b/hosts/hades/default.nix
index deaa941..0cb891b 100644
--- a/hosts/hades/default.nix
+++ b/hosts/hades/default.nix
@@ -76,6 +76,12 @@ in {
       secretConfigFile = config.age.secrets."matrix-synapse/secret-config".path;
     };
 
+    microbin = {
+      enable = true;
+      privatePort = 8088;
+      passwordFile = config.age.secrets."microbin/secret-config".path;
+    };
+
     miniflux = {
       enable = true;
       adminCredentialsFile = config.age.secrets."miniflux/admin-credentials".path;
diff --git a/hosts/hades/secrets.nix b/hosts/hades/secrets.nix
index 9f5b3c9..23b2cdb 100644
--- a/hosts/hades/secrets.nix
+++ b/hosts/hades/secrets.nix
@@ -21,6 +21,8 @@
           owner = "matrix-synapse";
         };
 
+        "microbin/secret-config" = {};
+
         "miniflux/admin-credentials" = {};
 
         "nextcloud/admin-pass" = {
diff --git a/modules/secrets/microbin/secret-config.age b/modules/secrets/microbin/secret-config.age
new file mode 100644
index 0000000000000000000000000000000000000000..e8750049724605d4109bab269aa83e5506ab3e77
GIT binary patch
literal 522
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7HcI!%DpxQtE_L)Z
za(7NO4hZzkN^#9gw<z|{4G##h$TJCXEHQHmD@rO&4mVCs59QL2a83<~G&6BcOi$1E
zH}})eOSVica7+nF$#P9MH_QwOH_vfP3(ikX2}HN8Ai|>3C|$uPH_*?-G2PwSE#1=C
zBEUJRAT7l#)yLA<-?Y>_!re6^(6z8EG{`AA!k4Qo*+|=^*f%7!#66|7JUb}OFE1sx
zAT-Ct*ex{6P~Xz9IIqAZwa`pk+Y@A)Rz!hos-~L1ZhBE_VsWZMrm?R>tf{s_Wt^TS
zSGbd9zL%3_j)`Y+g`aV@M|OH?W@e?ffnk}kL19s31(&X_u0mO0mRV6sdTEH0TTWn!
zXO@Y%Z;5fLd1{(tdbx?ec~XXXPPl7WMnz__FPGNh_m5N~ImIt6^Z)N}AM<(I7sJ=v
zZ%Ii!n~}4m{h93t5lxXJzV-9xS_<Y(t$Jo87`FF)-}I02B9p_O)>|r@-JN@hBi_8I
z?x4h^>!)V03)DVJGV_*8Oqjm#_mWwwpSR|g{}GVNyW#P(GSkFz!TP>{MGv=HX!T89
zvB&u9Hu3rL6Y`Iih&vqFpC$9%Vb+cXE|FIbPCat4^wF&c`<XW;-+ua_YKP640EQ<3
D|H{Q%

literal 0
HcmV?d00001

diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix
index 524c4d8..3b4229f 100644
--- a/modules/secrets/secrets.nix
+++ b/modules/secrets/secrets.nix
@@ -18,6 +18,8 @@ in {
 
   "matrix-synapse/secret-config.age".publicKeys = [alarsyo hades];
 
+  "microbin/secret-config.age".publicKeys = [alarsyo hades];
+
   "miniflux/admin-credentials.age".publicKeys = [alarsyo hades];
 
   "nextcloud/admin-pass.age".publicKeys = [alarsyo hades];
diff --git a/services/default.nix b/services/default.nix
index 68f98de..221159c 100644
--- a/services/default.nix
+++ b/services/default.nix
@@ -8,6 +8,7 @@
     ./lohr.nix
     ./matrix.nix
     ./media.nix
+    ./microbin.nix
     ./miniflux.nix
     ./monitoring.nix
     ./navidrome.nix
diff --git a/services/microbin.nix b/services/microbin.nix
new file mode 100644
index 0000000..a7c53d6
--- /dev/null
+++ b/services/microbin.nix
@@ -0,0 +1,82 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit
+    (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    ;
+
+  cfg = config.my.services.microbin;
+
+  domain = config.networking.domain;
+  hostname = config.networking.hostName;
+  fqdn = "${hostname}.${domain}";
+in {
+  options.my.services.microbin = let
+    inherit (lib) types;
+  in {
+    enable = mkEnableOption "MicroBin file sharing app";
+
+    privatePort = mkOption {
+      type = types.nullOr types.port;
+      default = null;
+      example = 8080;
+      description = "Port to serve the app";
+    };
+
+    passwordFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = "See NixOS module description";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.microbin = {
+      enable = true;
+      settings = {
+        MICROBIN_PORT = cfg.privatePort;
+        MICROBIN_BIND = "127.0.0.1";
+        MICROBIN_PUBLIC_PATH = "https://drop.${domain}/";
+        MICROBIN_READONLY = true;
+        MICROBIN_ENABLE_BURN_AFTER = true;
+        MICROBIN_ENABLE_READONLY = true;
+        MICROBIN_HIGHLIGHTSYNTAX = true;
+        MICROBIN_PRIVATE = true;
+        MICROBIN_THREADS = 2;
+        MICROBIN_GC_DAYS = 0; # turn off GC
+        MICROBIN_QR = true;
+        MICROBIN_ETERNAL_PASTA = true;
+        MICROBIN_DEFAULT_EXPIRY = "1week";
+        MICROBIN_DISABLE_TELEMETRY = true;
+      };
+      passwordFile = cfg.passwordFile;
+    };
+
+    my.services.restic-backup = {
+      paths = [
+        config.services.microbin.dataDir
+      ];
+    };
+
+    services.nginx = {
+      virtualHosts = {
+        "drop.${domain}" = {
+          forceSSL = true;
+          useACMEHost = fqdn;
+
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
+          };
+        };
+      };
+    };
+
+    security.acme.certs.${fqdn}.extraDomainNames = ["drop.${domain}"];
+  };
+}