Omega-Relay host replacement for Ubuntu VM on Feox

* Add omega-relay prototype host

* Add omega-relay prototype host

* Inital commit for working omega-relay host.

This commit includes:
- Mysql module from umbriel
- Disko configuration for the Ferox VM
- Freshrss module
- Stalwart module
- Vaultwarden module
- Wakapi module
- Uptime Kuma module
- Support for using mysql socket
- Server user that does not depend on full home-manager preset.
- ACME for wilkuu.xyz domains, including all the services.

* Nix fmt

* Fixes in secrets and services.

Mostly fixes connection to mysql and the unix-socket auth for it.

* Little fixes and update

* Format and do fixes

* Update secrets and keys for omega-relay

* Apply changes from messing around and making things work

1 files changed, 94 insertions, 0 deletions

diff --git a/services/freshrss.nix b/services/freshrss.nix
new file mode 100644
index 0000000..26a1853
--- /dev/null
+++ b/services/freshrss.nix
@@ -0,0 +1,94 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.wilkuu.services.freshrss;
+  hostname = config.networking.hostName;
+in
+{
+
+  options.wilkuu.services.freshrss = with lib; {
+    domain = mkOption {
+      type = types.str;
+      default = "rss.${hostname}.local";
+      example = "rss.wilkuu.xyz";
+      description = "Domain for http connections.";
+    };
+    doACME = mkEnableOption "Enable ACME for fresh-rss here";
+    enable = mkEnableOption "Enable the fresh-rss service";
+    dataDir = mkOption {
+      type = types.path;
+      description = "Storage localtion for fresh-rss data";
+      default = "/srv/data/freshrss";
+      example = "/srv/data/freshrss";
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      sopsPath = ../secrets/${hostname}/freshrss.yaml;
+      secrets = [
+        "admin_password"
+        "db_pass"
+      ];
+      toSops = (sname: "fresh-rss/${sname}");
+    in
+    {
+      networking.hosts = {
+        "127.0.0.1" = [ cfg.domain ];
+      };
+
+      sops.secrets = (
+        lib.genAttrs (map toSops secrets) (_name: {
+          sopsFile = sopsPath;
+          mode = "0440";
+          owner = config.services.freshrss.user;
+        })
+      );
+
+      services.nginx.virtualHosts."${cfg.domain}" = {
+        addSSL = cfg.doACME;
+        enableACME = cfg.doACME;
+      };
+
+      systemd.services.freshrss.after = [ "mysql.service" ];
+      wilkuu.services.mysql = {
+        enable = true;
+        users."freshrss" = {
+          sopsPlaceholder = config.sops.placeholder."fresh-rss/db_pass";
+	  host = "localhost";
+        };
+        databases."freshrss" = {
+          enable = true;
+          allowedUsers = [ "freshrss" ];
+        };
+      };
+
+      services.freshrss = {
+        enable = true;
+        # api.enable = true;
+        dataDir = cfg.dataDir;
+        baseUrl = "https://${cfg.domain}";
+        extensions = with pkgs.freshrss-extensions; [
+          youtube
+          title-wrap
+          auto-ttl
+          reading-time
+        ];
+        passwordFile = config.sops.secrets."fresh-rss/admin_password".path;
+        virtualHost = cfg.domain;
+        database = {
+          passFile = config.sops.secrets."fresh-rss/db_pass".path;
+          host = "127.0.0.1";
+          port = config.wilkuu.services.mysql.port;
+          name = "freshrss";
+          user = "freshrss";
+          type = "mysql";
+        };
+      };
+    }
+  );
+}