bebop: Add and enable tiddlywiki

flake.nix

@@ -86,6 +86,7 @@
             # ./modules/photoprism.nix
             ./modules/uptime_kuma.nix
             ./modules/rss.nix
+            ./modules/wiki.nix
 
             # Host-specific config
             nixos-hardware.nixosModules.raspberry-pi-4

hosts/hermes/secrets/secrets.nix

@@ -22,4 +22,5 @@ in
   "photoprism.age".publicKeys = [ ageKey ];
   "kavita_token_key.age".publicKeys = [ ageKey ];
   "freshrss.age".publicKeys = [ ageKey ];
+  "tiddlywiki.age".publicKeys = [ ageKey ];
 }

hosts/hermes/secrets/tiddlywiki.csv.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 dy7D9w 8uJu9sbRtEgcnMxtw7PdKi9iuwLnuwFTWIeqI0slAl0
+L4/RrSEvQycUcBn7Lg8oB1jD08tcp+2B6Qn6lC4f0xY
+-> NB-grease Li(J I?_-Z& sW iQXuLY
+5CD9im1/P5I+9X2enQlte4s8uq8M5pp6wiA
+--- teAQebIDqZAsJuiMXV12Bo3/+fPg8vHSWMqiuQcO8No
+«°~^ˆÌÛÌÚÇýï%LòvÎQÌm¢SÖ<53> RÏ‹Ì2°[èºò‘IRª1Ó"Š¨‹F…çâ=µ9yΔOÈRÓ,Ï3¾™ÒMÙK}¤

modules/wiki.nix

@@ -0,0 +1,43 @@
+{ ... }:
+{
+  # systemd.tmpfiles.rules = [
+  #   "f /run/agenix/freshrss 0770 freshrss freshrss -"
+  # ];
+
+  services = {
+    tiddlywiki = {
+      enable = true;
+      credentials = "/run/agenix/tiddlywiki.csv";
+      listenOptions = {
+        port = 33333;
+        readers = "(authenticated)";
+      };
+    };
+
+    nginx = {
+      virtualHosts = {
+        "wiki.bhankas.org" = {
+          addSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:33333";
+            proxyWebsockets = false;
+            extraConfig =
+              "proxy_set_header Host $host;"
+            ;
+          };
+        };
+      };
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    certs = {
+      "wiki.bhankas.org" = {
+        email = "admin@bhankas.org";
+        dnsResolver = "1.1.1.1:53";
+      };
+    };
+  };
+}