6 files changed, 166 insertions, 0 deletions
diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix
index 438e47c..66ccb29 100644
--- a/hosts/cloud/proxy/default.nix
+++ b/hosts/cloud/proxy/default.nix
@@ -4,6 +4,7 @@
     ./auth.nix
     ./dav.nix
     ./immich.nix
+    ./news.nix
   ];
 
   networking.firewall.allowedTCPPorts = [
diff --git a/hosts/cloud/proxy/news.nix b/hosts/cloud/proxy/news.nix
new file mode 100644
index 0000000..3bbfda2
--- /dev/null
+++ b/hosts/cloud/proxy/news.nix
@@ -0,0 +1,17 @@
+{ ... }:
+{
+  services.nginx.virtualHosts."news.oxapentane.com" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://10.89.88.14:8080";
+      extraConfig = ''
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_redirect off;
+      '';
+    };
+  };
+}
diff --git a/hosts/miniflux/default.nix b/hosts/miniflux/default.nix
new file mode 100644
index 0000000..5f166c3
--- /dev/null
+++ b/hosts/miniflux/default.nix
@@ -0,0 +1,78 @@
+
+{ config, lib, ... }:
+let
+  mac = "02:00:00:00:00:04";
+in
+{
+  imports = [
+    ./miniflux.nix
+  ];
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  microvm = {
+    hypervisor = "qemu";
+    mem = 4 * 1024;
+    vcpu = 2;
+    interfaces = [
+      {
+        type = "tap";
+        id = "uvm-miniflux";
+        mac = mac;
+      }
+    ];
+    shares =
+      [
+        {
+          source = "/nix/store";
+          mountPoint = "/nix/.ro-store";
+          tag = "store";
+          proto = "virtiofs";
+          socket = "store.socket";
+        }
+      ]
+      ++ map
+        (dir: {
+          source = dir;
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+          socket = "${dir}.socket";
+        })
+        [
+          "etc"
+          "var"
+          "home"
+        ];
+  };
+
+  networking.useNetworkd = true;
+  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+  systemd.network = {
+    enable = true;
+    networks."11-host" = {
+      matchConfig.MACAddress = mac;
+      networkConfig = {
+        Address = "10.99.99.14/24";
+        DHCP = "no";
+      };
+      routes = [
+        {
+          Gateway = "10.99.99.1";
+          Destination = "0.0.0.0/0";
+          Metric = 1024;
+        }
+      ];
+    };
+  };
+
+  networking.hostName = "miniflux";
+  system.stateVersion = "24.11";
+}
diff --git a/hosts/miniflux/miniflux.nix b/hosts/miniflux/miniflux.nix
new file mode 100644
index 0000000..8d068ea
--- /dev/null
+++ b/hosts/miniflux/miniflux.nix
@@ -0,0 +1,26 @@
+{ config, ... }:
+let
+  grp = "miniflux-secret";
+in
+{
+  sops.secrets."miniflux" = { };
+
+  services.miniflux = {
+    enable = true;
+    createDatabaseLocally = true;
+    adminCredentialsFile = config.sops.secrets."miniflux".path;
+    config = {
+      LOG_LEVEL="debug";
+      LISTEN_ADDR = "10.89.88.14:8080";
+      BASE_URL = "https://news.oxapentane.com";
+      # oauth
+      DISABLE_LOCAL_AUTH = 1;
+      CREATE_ADMIN = 0;
+      OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.oxapentane.com/application/o/miniflux/";
+      OAUTH2_PROVIDER = "oidc";
+      OAUTH2_REDIRECT_URL = "https://news.oxapentane.com/oauth2/oidc/callback";
+      OAUTH2_USER_CREATION = 1;
+      POLLING_FREQUENCY = 37;
+    };
+  };
+}
diff --git a/hosts/miniflux/secrets.yaml b/hosts/miniflux/secrets.yaml
new file mode 100644
index 0000000..30143fb
--- /dev/null
+++ b/hosts/miniflux/secrets.yaml
@@ -0,0 +1,43 @@
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:v8YxaUUnPuNAUU+3zvy5UzxNNMztaq5q1zli20JkAFdbgN+6SXzJeBcxs7M=,iv:0iPIrKtZzgxMMy2S+zLhEumitEEm8go1pfaN9D/e5C8=,tag:pw6DZFiFaL7skPxfUAGZ/A==,type:str]
+miniflux: ENC[AES256_GCM,data:KggPU65HAQbkBwebFw/CibolkenAUfZacz0tXruHQhExMwuHALOuxVVeATjp6nQoNfa3XNYN5w9EPhNWwvx0k98o7vxdg1pCQs1zu7UM9QiFykwYNlZQcbTMvBCoZkPwcjukvIwW25WrwDQREPv84kL7HvXPg6J8lM4x4WMbxW2t2qDjOt4SQE7bbXHZOliAW0YYb9KG8V2Mcg7GnPL/aWv7t0qur3ZACR0GgVFJIV90+qtVmr8wsOo60TtwDxOXkLFeHDdH67LxqQWry6v9RQ==,iv:Sv62ohd8tY9SMC/i3W4o/QP59Ka7w/5kk+R0Rhu3X0E=,tag:a5Ksf6V/lmLcqLZa4Qo+7Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ejVOQXZ6UExVbkFLdkhT
+            TTN0TEFIYWJGUnNGekhWT2J2RjhabVN6M204CnRWcGdNWHFhcVNIT05WYzBGVThT
+            bzR4VjF5V2gvNWZaYi9iN0ZQa1R0ejgKLS0tIGJxVVRxNUd6d0hxT2tZaVdVU1Rn
+            NXh3QWYrMkFhdzV4bE9GY09nTzJUclUKwXlC3R+A2cdk8Q9vzceA2FMSBtfu0SZU
+            x32/tjQvRE7B/nsZHP3BSq0DXoTTtE1huNPHcvy0CC28HhNPsmFUNQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-25T01:09:45Z"
+    mac: ENC[AES256_GCM,data:euRvs3gMaxqcTzDhacFdBVPprggN0eNki0g7BKuCr85se52CzpSCj13OF5LJE4Wl3vVOuGbpOsGUKjKKHANGddgPRPvs+zGYKrtcI1fYLE7XJXm5CwxvCcnTqmDCx+8WtXLhFhXVTCXOOx3miB03IC+i8kdZ0LLTTig2oWEFxZo=,iv:tVZPvRsX0XTwBxjuKCP8mGCMmKWTjFKUTMdCgddM9SE=,tag:AywLDckO/ZjORRXxbjQ14w==,type:str]
+    pgp:
+        - created_at: "2025-01-24T22:21:30Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7zUOKwzpAE7AQ//buLyt9yBVQr+fQLoBG6kYp3UIxvgklWtnBZQ8/QjXE8r
+            QsTJ0VLLhmb70Thrc/0OC29z6ddsroIogUBT8tFtyhZZ7aKc8NGVA/7c0/C5Vi7i
+            FazyogLOcMeN+E069XgVOJ5xQ7WINJgV1l3I9G0C4OKlwkfEVTcV7kdMlAjpmY47
+            7rSLYjV2lUw6xN90dQ71BWNLHMJL9wDC8R3QbMw2X1/Xocgm8WS3b7A4jWUpPn9U
+            eN4KJ6ITWVo79moBcFUn8/J26lZ2SfdVZiYehR8yaeSD5OPUkkZ/+YsoUKBR2Kkd
+            debCc/KkmL+cQzUonLHnjoKSod6oCzK77O7f5YuPW7vmbnZGsxw8FCUPXStC3bT/
+            lMZva22SBrTp2drfWk8E/SnM5WlseObBa/pFC2RWXq8aYsBScVnwnbMzN3W1c8oq
+            aCyZKYONLmOVnBVX46xrZZ4EgpEBOzR+m+Jbed1DB03Nfm1HB3llF01xxkKVv94H
+            soGnyu3Z1PfPtzAOCLTPuZV5k4whMjuGbusiuHH9jzwth07FyUP+cG59Qsh7gibx
+            pV6APc5EMPsYuH1GMIppSnLc+QospcAY5jagtN8mOebyKlMlc5kpcPWhIkAmHVuk
+            GgqCGO32W49EZA+A5VBzq+smy5QqdStgT6oVnrEfhRAsZncK/ffiXtWlMI/ASijS
+            XAFUIG3CWMs224S+F+3kQcwLaeVN2liRNQJSdzI5SSFUALigS3kgbGKeBj9LX+Gp
+            yLV6Nx2xPX7Epf59397LAyK7lDI7YXeoWTRzCkbnYKXJl+sDsg56V5xzzHEm
+            =XnHE
+            -----END PGP MESSAGE-----
+          fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2
diff --git a/hosts/minime/uvm.nix b/hosts/minime/uvm.nix
index 437f873..93f2253 100644
--- a/hosts/minime/uvm.nix
+++ b/hosts/minime/uvm.nix
@@ -5,6 +5,7 @@
     "auth"
     "radicale"
     "immich"
+    "miniflux"
   ];
   microvm.vms = {
     auth = {