1 files changed, 61 insertions, 0 deletions
diff --git a/services/kanboard.nix b/services/kanboard.nix
new file mode 100644
index 0000000..c19b673
--- /dev/null
+++ b/services/kanboard.nix
@@ -0,0 +1,61 @@
+{pkgs, config, lib, ...}:
+  let 
+    cfg = config.wilkuu.services.kanboard; 
+    inherit (lib) mkEnableOption mkOption types mkIf; 
+  in 
+{
+  options.wilkuu.services.kanboard = {
+    enable = mkEnableOption "kanboard"; 
+    domain = mkOption {
+      type = types.str; 
+      example = "kb.wilkuu.xyz";
+    };
+  }; 
+
+  config = mkIf cfg.enable {
+    wilkuu.services.mysql.unix_users = ["kanboard"];
+    wilkuu.mjmap = { 
+      enable = lib.mkDefault true; 
+      users = ["kanboard"];
+    };  
+    sops.secrets."kanboard/db_password" = {
+      sopsFile = ../secrets/${config.networking.hostName}/kanboard.yaml; 
+      owner = "kanboard"; 
+      mode = "500"; 
+    };  
+    sops.templates."kanboard-env" = {
+      content = ''
+        DB_PASSWORD=${config.sops.placeholder."kanboard/db_password"}
+        PLUGIN_INSTALLER=true
+      ''; 
+      owner = "kanboard"; 
+      mode  = "500"; 
+    };
+    systemd.services.phpfpm-kanboard.serviceConfig = {
+      EnvironmentFile = config.sops.templates."kanboard-env".path; 
+    };  
+    services.kanboard = {
+      nginx = {
+        enableACME = false;
+        forceSSL = false;
+        addSSL = false; 
+      };
+      domain = cfg.domain; 
+      enable = true; 
+      settings = {
+        PLUGIN_INSTALLER = "$PLUGIN_INSTALLER";
+        PLUGINS_DIR = "${config.services.kanboard.dataDir}/plugins";
+        MAIL_FROM = "Kanboard <noreply@wilkuu.nl>"; 
+        MAIL_TRANSPORT = "sendmail";
+        MAIL_SENDMAIL_COMMAND = "sendmail";
+        DB_DRIVER = "mysql"; 
+        DB_USERNAME = "kanboard"; 
+        DB_HOSTNAME = "127.0.0.1;unix_socket=/run/mysqld/mysqld.sock";
+        DB_PASSWORD = "$DB_PASSWORD"; 
+        ENABLE_URL_REWRITE = true;
+        TRUSTED_PROXY_HEADERS = "HOST,X-REAL-IP,X-FORWARDED-FOR,X-FORWARDED-HOST,X-FORWARDED-SERVER";
+        TRUSTED_PROXY_NETWORKS = "192.168.80.0/24,192.168.88.0/24";
+      };
+    };
+  };
+}