diff options
Diffstat (limited to 'microvms/miniflux')
| -rw-r--r-- | microvms/miniflux/default.nix | 78 | ||||
| -rw-r--r-- | microvms/miniflux/miniflux.nix | 22 | ||||
| -rw-r--r-- | microvms/miniflux/secrets.yaml | 38 |
3 files changed, 138 insertions, 0 deletions
diff --git a/microvms/miniflux/default.nix b/microvms/miniflux/default.nix new file mode 100644 index 0000000..d2f024f --- /dev/null +++ b/microvms/miniflux/default.nix @@ -0,0 +1,78 @@ +{ config, lib, ... }: +let + mac = "02:00:00:00:00:04"; +in +{ + imports = [ + ./miniflux.nix + ]; + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + }; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + 4; + mem = 1 * 1024; + vcpu = 2; + interfaces = [ + { + type = "tap"; + id = "uvm-miniflux"; + mac = mac; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = mac; + networkConfig = { + Address = "10.99.99.14/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + + networking.hostName = "miniflux"; + system.stateVersion = "24.11"; +} diff --git a/microvms/miniflux/miniflux.nix b/microvms/miniflux/miniflux.nix new file mode 100644 index 0000000..9afbe29 --- /dev/null +++ b/microvms/miniflux/miniflux.nix @@ -0,0 +1,22 @@ +{ config, ... }: +{ + sops.secrets."miniflux" = { }; + + services.miniflux = { + enable = true; + createDatabaseLocally = true; + adminCredentialsFile = config.sops.secrets."miniflux".path; + config = { + LISTEN_ADDR = "10.89.88.14:8080"; + BASE_URL = "https://news.oxapentane.com"; + # oauth + DISABLE_LOCAL_AUTH = 1; + CREATE_ADMIN = 0; + OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.oxapentane.com/application/o/miniflux/"; + OAUTH2_PROVIDER = "oidc"; + OAUTH2_REDIRECT_URL = "https://news.oxapentane.com/oauth2/oidc/callback"; + OAUTH2_USER_CREATION = 1; + POLLING_FREQUENCY = 37; + }; + }; +} diff --git a/microvms/miniflux/secrets.yaml b/microvms/miniflux/secrets.yaml new file mode 100644 index 0000000..39cb3b9 --- /dev/null +++ b/microvms/miniflux/secrets.yaml @@ -0,0 +1,38 @@ +wg: + 0xa-proxy: ENC[AES256_GCM,data:v8YxaUUnPuNAUU+3zvy5UzxNNMztaq5q1zli20JkAFdbgN+6SXzJeBcxs7M=,iv:0iPIrKtZzgxMMy2S+zLhEumitEEm8go1pfaN9D/e5C8=,tag:pw6DZFiFaL7skPxfUAGZ/A==,type:str] +miniflux: ENC[AES256_GCM,data:KggPU65HAQbkBwebFw/CibolkenAUfZacz0tXruHQhExMwuHALOuxVVeATjp6nQoNfa3XNYN5w9EPhNWwvx0k98o7vxdg1pCQs1zu7UM9QiFykwYNlZQcbTMvBCoZkPwcjukvIwW25WrwDQREPv84kL7HvXPg6J8lM4x4WMbxW2t2qDjOt4SQE7bbXHZOliAW0YYb9KG8V2Mcg7GnPL/aWv7t0qur3ZACR0GgVFJIV90+qtVmr8wsOo60TtwDxOXkLFeHDdH67LxqQWry6v9RQ==,iv:Sv62ohd8tY9SMC/i3W4o/QP59Ka7w/5kk+R0Rhu3X0E=,tag:a5Ksf6V/lmLcqLZa4Qo+7Q==,type:str] +sops: + age: + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBZcEJZ + cTFGMmhjN29zWHQ4WURmWXgzZEZkRml0a0F0Y2dKU3ppcEJmd1FnCkdOYk5ObEFI + QWFHT3MrQlI2TkVEd1VYOVcwbjM5Z0xpV1BsUmExd3J2STgKLS0tIDVnemRKc01X + ekxGS0NLYjZLMm9UVm5Zc2NZY0hxSFNtRGlJYlpBZk0zQW8Kzv4W9yy8qWP4EQbr + KA4BncMHEWQ6xcnD1l3iFHIUeG8EqvH3N3eOZ/8OrPfZDkYHcbVMmtmQl5sDOv9P + 3b+TwA== + -----END AGE ENCRYPTED FILE----- + - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSAzZWJj + YVBnYmNqV1drdDhIMnpBTE9BVCtpcmRvUVJkSHU5clNkNVBhaFJBCnlsU2M0Z0tl + dE53V0graVBMNTVQT0o4bDVueGtQUkM1aGJzMUFEbVVmd3MKLS0tIE51SkdYNWVa + SFo0K00wUXRhaXI0Tkw0SnlhZ01oRExkcVAwWkovblplY2MKp+F3ai1mKWgHVjx8 + Qr72eoyQJ4+OjzKV1eqGNGLqb8H+qP6ynAQeLpQuhs/rLUxM/nZy47uPE5mllIoN + 4/39SQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQjNONFc0T1JxSHB6S0F5 + bWVZQzlyZXY3VmRWNllWL29jNEVXNWxoeGlZCkdtOFRCakd5bVFTSzVlVFpFV3M5 + VmlWRFV5U0F5QXZwMU9IT3NWeWx1cjQKLS0tIEpwaVdZVTA1ZzllbE9YOFZvMVdS + ZU1pN0pLZTRXb0NKNFlWakY1L0x0ZHMKMmhFFufDWZMPxjB9eIf0rJmdIzabQWKk + 4NcZwriNtTHRPKnqHF/eoV7jOjN17A9mzz1Ln1LZDwFg5iFtIrjNYw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-25T01:09:45Z" + mac: ENC[AES256_GCM,data:euRvs3gMaxqcTzDhacFdBVPprggN0eNki0g7BKuCr85se52CzpSCj13OF5LJE4Wl3vVOuGbpOsGUKjKKHANGddgPRPvs+zGYKrtcI1fYLE7XJXm5CwxvCcnTqmDCx+8WtXLhFhXVTCXOOx3miB03IC+i8kdZ0LLTTig2oWEFxZo=,iv:tVZPvRsX0XTwBxjuKCP8mGCMmKWTjFKUTMdCgddM9SE=,tag:AywLDckO/ZjORRXxbjQ14w==,type:str] + unencrypted_suffix: _unencrypted + version: 3.9.2 |