bebop: Add and enable FreshRSS

flake.nix

@@ -85,6 +85,7 @@
             ./modules/etesync.nix
             # ./modules/photoprism.nix
             ./modules/uptime_kuma.nix
+            ./modules/rss.nix
 
             # Host-specific config
             nixos-hardware.nixosModules.raspberry-pi-4

hosts/hermes/secrets/freshrss.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 dy7D9w 3ploAJxiGTgVudSEV3LKj0C3qSHfna7o4fR6EfDtVno
+QJJPqi0qbM7lWWsKWpZgAYooYz2kwvj1LWJsi0h+LDE
+-> g^OgA"-grease A+rY{/ q)_ v~NIM6 ;_
+ldxobJIAPEkFrBZOIp1O1aknLcQ/LrAGb0WKGG5cGcFo0OacVNFVzzP8rmDh
+--- P0fgjQNGfP6GccyTF4VxzquWnxzP5hJTL+Gmm472kf4
+¯"¨{ÇÜÙª•ï'”¾~@¥¾u›(^bˆyiÙ,Ô<>Še©˜iª·äv¹ÉôYÙ/dI#‘LJå¯"ˆRkQÂqJl¤{D†U£±,LîGÝ$

hosts/hermes/secrets/secrets.nix

@@ -21,4 +21,5 @@ in
   "etebase.age".publicKeys = [ ageKey ];
   "photoprism.age".publicKeys = [ ageKey ];
   "kavita_token_key.age".publicKeys = [ ageKey ];
+  "freshrss.age".publicKeys = [ ageKey ];
 }

modules/rss.nix

@@ -0,0 +1,47 @@
+{ ... }:
+{
+  systemd.tmpfiles.rules = [
+    "f /run/agenix/freshrss 0770 freshrss freshrss -"
+  ];
+
+  services = {
+    freshrss = {
+      enable = true;
+      language = "en";
+      baseUrl = "https://rss.bhankas.org";
+      defaultUser = "payas";
+      passwordFile = "/run/agenix/freshrss";
+      authType = "form";
+      database = {
+        type = "sqlite";
+      };
+      virtualHost = null; # set explicitly below
+    };
+
+    nginx = {
+      virtualHosts = {
+        "rss.bhankas.org" = {
+          addSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:28981";
+            proxyWebsockets = false;
+            extraConfig =
+              "proxy_set_header Host $host;"
+            ;
+          };
+        };
+      };
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    certs = {
+      "rss.bhankas.org" = {
+        email = "admin@bhankas.org";
+        dnsResolver = "1.1.1.1:53";
+      };
+    };
+  };
+}