From a38e90adf7d746cc9cb1c1e02a615e32556597fa Mon Sep 17 00:00:00 2001
From: Grisha Shipunov
Date: Sun, 26 Jul 2026 08:45:30 +0000
Subject: move microvms to separate folder

---
 microvms/miniflux/default.nix  | 78 ++++++++++++++++++++++++++++++++++++++++++
 microvms/miniflux/miniflux.nix | 22 ++++++++++++
 microvms/miniflux/secrets.yaml | 38 ++++++++++++++++++++
 3 files changed, 138 insertions(+)
 create mode 100644 microvms/miniflux/default.nix
 create mode 100644 microvms/miniflux/miniflux.nix
 create mode 100644 microvms/miniflux/secrets.yaml

(limited to 'microvms/miniflux')

diff --git a/microvms/miniflux/default.nix b/microvms/miniflux/default.nix
new file mode 100644
index 0000000..d2f024f
--- /dev/null
+++ b/microvms/miniflux/default.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  mac = "02:00:00:00:00:04";
+in
+{
+  imports = [
+    ./miniflux.nix
+  ];
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  microvm = {
+    hypervisor = "cloud-hypervisor";
+    vsock.cid = 3 + 4;
+    mem = 1 * 1024;
+    vcpu = 2;
+    interfaces = [
+      {
+        type = "tap";
+        id = "uvm-miniflux";
+        mac = mac;
+      }
+    ];
+    shares = [
+      {
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+        tag = "store";
+        proto = "virtiofs";
+        socket = "store.socket";
+      }
+    ]
+    ++
+      map
+        (dir: {
+          source = dir;
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+          socket = "${dir}.socket";
+        })
+        [
+          "etc"
+          "var"
+          "home"
+        ];
+  };
+
+  networking.useNetworkd = true;
+  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+  systemd.network = {
+    enable = true;
+    networks."11-host" = {
+      matchConfig.MACAddress = mac;
+      networkConfig = {
+        Address = "10.99.99.14/24";
+        DHCP = "no";
+      };
+      routes = [
+        {
+          Gateway = "10.99.99.1";
+          Destination = "0.0.0.0/0";
+          Metric = 1024;
+        }
+      ];
+    };
+  };
+
+  networking.hostName = "miniflux";
+  system.stateVersion = "24.11";
+}
diff --git a/microvms/miniflux/miniflux.nix b/microvms/miniflux/miniflux.nix
new file mode 100644
index 0000000..9afbe29
--- /dev/null
+++ b/microvms/miniflux/miniflux.nix
@@ -0,0 +1,22 @@
+{ config, ... }:
+{
+  sops.secrets."miniflux" = { };
+
+  services.miniflux = {
+    enable = true;
+    createDatabaseLocally = true;
+    adminCredentialsFile = config.sops.secrets."miniflux".path;
+    config = {
+      LISTEN_ADDR = "10.89.88.14:8080";
+      BASE_URL = "https://news.oxapentane.com";
+      # oauth
+      DISABLE_LOCAL_AUTH = 1;
+      CREATE_ADMIN = 0;
+      OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.oxapentane.com/application/o/miniflux/";
+      OAUTH2_PROVIDER = "oidc";
+      OAUTH2_REDIRECT_URL = "https://news.oxapentane.com/oauth2/oidc/callback";
+      OAUTH2_USER_CREATION = 1;
+      POLLING_FREQUENCY = 37;
+    };
+  };
+}
diff --git a/microvms/miniflux/secrets.yaml b/microvms/miniflux/secrets.yaml
new file mode 100644
index 0000000..39cb3b9
--- /dev/null
+++ b/microvms/miniflux/secrets.yaml
@@ -0,0 +1,38 @@
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:v8YxaUUnPuNAUU+3zvy5UzxNNMztaq5q1zli20JkAFdbgN+6SXzJeBcxs7M=,iv:0iPIrKtZzgxMMy2S+zLhEumitEEm8go1pfaN9D/e5C8=,tag:pw6DZFiFaL7skPxfUAGZ/A==,type:str]
+miniflux: ENC[AES256_GCM,data:KggPU65HAQbkBwebFw/CibolkenAUfZacz0tXruHQhExMwuHALOuxVVeATjp6nQoNfa3XNYN5w9EPhNWwvx0k98o7vxdg1pCQs1zu7UM9QiFykwYNlZQcbTMvBCoZkPwcjukvIwW25WrwDQREPv84kL7HvXPg6J8lM4x4WMbxW2t2qDjOt4SQE7bbXHZOliAW0YYb9KG8V2Mcg7GnPL/aWv7t0qur3ZACR0GgVFJIV90+qtVmr8wsOo60TtwDxOXkLFeHDdH67LxqQWry6v9RQ==,iv:Sv62ohd8tY9SMC/i3W4o/QP59Ka7w/5kk+R0Rhu3X0E=,tag:a5Ksf6V/lmLcqLZa4Qo+7Q==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBZcEJZ
+            cTFGMmhjN29zWHQ4WURmWXgzZEZkRml0a0F0Y2dKU3ppcEJmd1FnCkdOYk5ObEFI
+            QWFHT3MrQlI2TkVEd1VYOVcwbjM5Z0xpV1BsUmExd3J2STgKLS0tIDVnemRKc01X
+            ekxGS0NLYjZLMm9UVm5Zc2NZY0hxSFNtRGlJYlpBZk0zQW8Kzv4W9yy8qWP4EQbr
+            KA4BncMHEWQ6xcnD1l3iFHIUeG8EqvH3N3eOZ/8OrPfZDkYHcbVMmtmQl5sDOv9P
+            3b+TwA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSAzZWJj
+            YVBnYmNqV1drdDhIMnpBTE9BVCtpcmRvUVJkSHU5clNkNVBhaFJBCnlsU2M0Z0tl
+            dE53V0graVBMNTVQT0o4bDVueGtQUkM1aGJzMUFEbVVmd3MKLS0tIE51SkdYNWVa
+            SFo0K00wUXRhaXI0Tkw0SnlhZ01oRExkcVAwWkovblplY2MKp+F3ai1mKWgHVjx8
+            Qr72eoyQJ4+OjzKV1eqGNGLqb8H+qP6ynAQeLpQuhs/rLUxM/nZy47uPE5mllIoN
+            4/39SQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQjNONFc0T1JxSHB6S0F5
+            bWVZQzlyZXY3VmRWNllWL29jNEVXNWxoeGlZCkdtOFRCakd5bVFTSzVlVFpFV3M5
+            VmlWRFV5U0F5QXZwMU9IT3NWeWx1cjQKLS0tIEpwaVdZVTA1ZzllbE9YOFZvMVdS
+            ZU1pN0pLZTRXb0NKNFlWakY1L0x0ZHMKMmhFFufDWZMPxjB9eIf0rJmdIzabQWKk
+            4NcZwriNtTHRPKnqHF/eoV7jOjN17A9mzz1Ln1LZDwFg5iFtIrjNYw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-25T01:09:45Z"
+    mac: ENC[AES256_GCM,data:euRvs3gMaxqcTzDhacFdBVPprggN0eNki0g7BKuCr85se52CzpSCj13OF5LJE4Wl3vVOuGbpOsGUKjKKHANGddgPRPvs+zGYKrtcI1fYLE7XJXm5CwxvCcnTqmDCx+8WtXLhFhXVTCXOOx3miB03IC+i8kdZ0LLTTig2oWEFxZo=,iv:tVZPvRsX0XTwBxjuKCP8mGCMmKWTjFKUTMdCgddM9SE=,tag:AywLDckO/ZjORRXxbjQ14w==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2
-- 
cgit v1.3.1