miniflux: setup service

.gitignore

@@ -1 +1,2 @@
 borg-backup-repo
+miniflux-admin-credentials

configuration.nix

@@ -80,13 +80,20 @@
       ];
       exclude = [];
     };
+
+    miniflux = {
+      enable = true;
+      adminCredentialsFile = "${./miniflux-admin-credentials}";
+      privatePort = 8080;
+    };
+
+    matrix.enable = true;
+
     monitoring = {
       enable = true;
       useACME = true;
       domain = "monitoring.${config.networking.domain}";
     };
-
-    matrix.enable = true;
   };
 
   security.acme.acceptTerms = true;

miniflux-admin-credentials.example

@@ -0,0 +1,2 @@
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD=password

services/default.nix

@@ -4,6 +4,7 @@
   imports = [
     ./borg-backup.nix
     ./matrix.nix
+    ./miniflux.nix
     ./monitoring.nix
   ];
 }

services/miniflux.nix

@@ -0,0 +1,65 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.my.services.miniflux;
+
+  domain = config.networking.domain;
+in {
+  options.my.services.miniflux = {
+    enable = mkEnableOption "Serve a Miniflux instance";
+
+    adminCredentialsFile = mkOption {
+      type = types.str;
+      default = null;
+      example = "./secrets/miniflux-admin-credentials";
+      description = "File containing ADMIN_USERNAME= and ADMIN_PASSWORD=";
+    };
+
+    privatePort = mkOption {
+      type = types.int;
+      default = 8080;
+      example = 8080;
+      description = "Port to serve the app";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # services.postgresql is automatically enabled by services.miniflux, let's
+    # back it up
+    services.postgresqlBackup = {
+      databases = [ "miniflux" ];
+    };
+
+    services.miniflux = {
+      enable = true;
+      adminCredentialsFile = cfg.adminCredentialsFile;
+      # TODO: setup metrics collection
+      config = {
+        LISTEN_ADDR = "127.0.0.1:${toString cfg.privatePort}";
+        BASE_URL = "https://reader.${domain}/";
+      };
+    };
+
+    services.nginx = {
+      enable = true;
+
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedTlsSettings = true;
+      recommendedProxySettings = true;
+
+      virtualHosts = {
+        "reader.${domain}" = {
+          forceSSL = true;
+          enableACME = true;
+
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
+          };
+        };
+      };
+    };
+  };
+}