miniflux: init

.sops.yaml

@@ -8,6 +8,7 @@ keys:
   - &auth age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8
   - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c
   - &immich age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
+  - &miniflux age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh
 creation_rules:
   - path_regex: hosts/toaster/[^/]+\.yaml$
     key_groups:
@@ -45,3 +46,9 @@ creation_rules:
         - *admin_oxa
         age:
         - *immich
+  - path_regex: hosts/miniflux/[^/]+\.yaml$
+    key_groups:
+      - pgp:
+        - *admin_oxa
+        age:
+        - *miniflux

flake.nix

@@ -142,6 +142,19 @@
           ];
         };
 
+        miniflux = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          specialArgs = { inherit inputs; };
+          modules = [
+            sops-nix.nixosModules.sops
+            microvm.nixosModules.microvm
+
+            ./hosts/miniflux
+            ./modules/server
+            ./modules/wg
+          ];
+        };
+
         radicale = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = { inherit inputs; };

hosts/cloud/proxy/default.nix

@@ -4,6 +4,7 @@
     ./auth.nix
     ./dav.nix
     ./immich.nix
+    ./news.nix
   ];
 
   networking.firewall.allowedTCPPorts = [

hosts/cloud/proxy/news.nix

@@ -0,0 +1,17 @@
+{ ... }:
+{
+  services.nginx.virtualHosts."news.oxapentane.com" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://10.89.88.14:8080";
+      extraConfig = ''
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_redirect off;
+      '';
+    };
+  };
+}

hosts/miniflux/default.nix

@@ -0,0 +1,78 @@
+
+{ config, lib, ... }:
+let
+  mac = "02:00:00:00:00:04";
+in
+{
+  imports = [
+    ./miniflux.nix
+  ];
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  microvm = {
+    hypervisor = "qemu";
+    mem = 4 * 1024;
+    vcpu = 2;
+    interfaces = [
+      {
+        type = "tap";
+        id = "uvm-miniflux";
+        mac = mac;
+      }
+    ];
+    shares =
+      [
+        {
+          source = "/nix/store";
+          mountPoint = "/nix/.ro-store";
+          tag = "store";
+          proto = "virtiofs";
+          socket = "store.socket";
+        }
+      ]
+      ++ map
+        (dir: {
+          source = dir;
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+          socket = "${dir}.socket";
+        })
+        [
+          "etc"
+          "var"
+          "home"
+        ];
+  };
+
+  networking.useNetworkd = true;
+  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+  systemd.network = {
+    enable = true;
+    networks."11-host" = {
+      matchConfig.MACAddress = mac;
+      networkConfig = {
+        Address = "10.99.99.14/24";
+        DHCP = "no";
+      };
+      routes = [
+        {
+          Gateway = "10.99.99.1";
+          Destination = "0.0.0.0/0";
+          Metric = 1024;
+        }
+      ];
+    };
+  };
+
+  networking.hostName = "miniflux";
+  system.stateVersion = "24.11";
+}

hosts/miniflux/miniflux.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+let
+  grp = "miniflux-secret";
+in
+{
+  sops.secrets."miniflux" = { };
+
+  services.miniflux = {
+    enable = true;
+    createDatabaseLocally = true;
+    adminCredentialsFile = config.sops.secrets."miniflux".path;
+    config = {
+      LOG_LEVEL="debug";
+      LISTEN_ADDR = "10.89.88.14:8080";
+      BASE_URL = "https://news.oxapentane.com";
+      # oauth
+      DISABLE_LOCAL_AUTH = 1;
+      CREATE_ADMIN = 0;
+      OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.oxapentane.com/application/o/miniflux/";
+      OAUTH2_PROVIDER = "oidc";
+      OAUTH2_REDIRECT_URL = "https://news.oxapentane.com/oauth2/oidc/callback";
+      OAUTH2_USER_CREATION = 1;
+      POLLING_FREQUENCY = 37;
+    };
+  };
+}

hosts/miniflux/secrets.yaml

@@ -0,0 +1,43 @@
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:v8YxaUUnPuNAUU+3zvy5UzxNNMztaq5q1zli20JkAFdbgN+6SXzJeBcxs7M=,iv:0iPIrKtZzgxMMy2S+zLhEumitEEm8go1pfaN9D/e5C8=,tag:pw6DZFiFaL7skPxfUAGZ/A==,type:str]
+miniflux: ENC[AES256_GCM,data:KggPU65HAQbkBwebFw/CibolkenAUfZacz0tXruHQhExMwuHALOuxVVeATjp6nQoNfa3XNYN5w9EPhNWwvx0k98o7vxdg1pCQs1zu7UM9QiFykwYNlZQcbTMvBCoZkPwcjukvIwW25WrwDQREPv84kL7HvXPg6J8lM4x4WMbxW2t2qDjOt4SQE7bbXHZOliAW0YYb9KG8V2Mcg7GnPL/aWv7t0qur3ZACR0GgVFJIV90+qtVmr8wsOo60TtwDxOXkLFeHDdH67LxqQWry6v9RQ==,iv:Sv62ohd8tY9SMC/i3W4o/QP59Ka7w/5kk+R0Rhu3X0E=,tag:a5Ksf6V/lmLcqLZa4Qo+7Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ejVOQXZ6UExVbkFLdkhT
+            TTN0TEFIYWJGUnNGekhWT2J2RjhabVN6M204CnRWcGdNWHFhcVNIT05WYzBGVThT
+            bzR4VjF5V2gvNWZaYi9iN0ZQa1R0ejgKLS0tIGJxVVRxNUd6d0hxT2tZaVdVU1Rn
+            NXh3QWYrMkFhdzV4bE9GY09nTzJUclUKwXlC3R+A2cdk8Q9vzceA2FMSBtfu0SZU
+            x32/tjQvRE7B/nsZHP3BSq0DXoTTtE1huNPHcvy0CC28HhNPsmFUNQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-25T01:09:45Z"
+    mac: ENC[AES256_GCM,data:euRvs3gMaxqcTzDhacFdBVPprggN0eNki0g7BKuCr85se52CzpSCj13OF5LJE4Wl3vVOuGbpOsGUKjKKHANGddgPRPvs+zGYKrtcI1fYLE7XJXm5CwxvCcnTqmDCx+8WtXLhFhXVTCXOOx3miB03IC+i8kdZ0LLTTig2oWEFxZo=,iv:tVZPvRsX0XTwBxjuKCP8mGCMmKWTjFKUTMdCgddM9SE=,tag:AywLDckO/ZjORRXxbjQ14w==,type:str]
+    pgp:
+        - created_at: "2025-01-24T22:21:30Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7zUOKwzpAE7AQ//buLyt9yBVQr+fQLoBG6kYp3UIxvgklWtnBZQ8/QjXE8r
+            QsTJ0VLLhmb70Thrc/0OC29z6ddsroIogUBT8tFtyhZZ7aKc8NGVA/7c0/C5Vi7i
+            FazyogLOcMeN+E069XgVOJ5xQ7WINJgV1l3I9G0C4OKlwkfEVTcV7kdMlAjpmY47
+            7rSLYjV2lUw6xN90dQ71BWNLHMJL9wDC8R3QbMw2X1/Xocgm8WS3b7A4jWUpPn9U
+            eN4KJ6ITWVo79moBcFUn8/J26lZ2SfdVZiYehR8yaeSD5OPUkkZ/+YsoUKBR2Kkd
+            debCc/KkmL+cQzUonLHnjoKSod6oCzK77O7f5YuPW7vmbnZGsxw8FCUPXStC3bT/
+            lMZva22SBrTp2drfWk8E/SnM5WlseObBa/pFC2RWXq8aYsBScVnwnbMzN3W1c8oq
+            aCyZKYONLmOVnBVX46xrZZ4EgpEBOzR+m+Jbed1DB03Nfm1HB3llF01xxkKVv94H
+            soGnyu3Z1PfPtzAOCLTPuZV5k4whMjuGbusiuHH9jzwth07FyUP+cG59Qsh7gibx
+            pV6APc5EMPsYuH1GMIppSnLc+QospcAY5jagtN8mOebyKlMlc5kpcPWhIkAmHVuk
+            GgqCGO32W49EZA+A5VBzq+smy5QqdStgT6oVnrEfhRAsZncK/ffiXtWlMI/ASijS
+            XAFUIG3CWMs224S+F+3kQcwLaeVN2liRNQJSdzI5SSFUALigS3kgbGKeBj9LX+Gp
+            yLV6Nx2xPX7Epf59397LAyK7lDI7YXeoWTRzCkbnYKXJl+sDsg56V5xzzHEm
+            =XnHE
+            -----END PGP MESSAGE-----
+          fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2

hosts/minime/uvm.nix

@@ -5,6 +5,7 @@
     "auth"
     "radicale"
     "immich"
+    "miniflux"
   ];
   microvm.vms = {
     auth = {

modules/wg/proxy.nix

@@ -47,6 +47,14 @@
           publicKey = "NXBlfKx4udjI6C7Dcp1Us7lYnE+L0avnMb1VSLxj42s=";
           privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
         };
+        "miniflux" = {
+          address = [
+            "10.89.88.14/24"
+            "fd31:185d:722f::14/48"
+          ];
+          publicKey = "2Lvjzg8k5EIR0Y5mlsCHOs1cJl1+1SL0QMxkKUmliE0=";
+          privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
+        };
       };
     }
   ];