all repos — nixfiles @ 9ceb482b714b5a2d39f0898323ffc33ea2eae1ca

System and user configuration, managed by nix and home-manager

system/roles/readeck.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
{
  config,
  ...
}:
let
  data = import ../../data;
in
{
  age.secrets.readeck.file = ../../secrets/readeck.age;

  services.readeck = {
    enable = true;
    environmentFile = config.age.secrets.readeck.path;
    settings = {
      server = {
        host = "unix:/run/web/readeck.sock?mode=0660";
        base_url = "https://read.${data.tailnet}";
      };
      email = {
        host = "localhost";
        port = 587;
        from = "readeck@${data.pubnet}";
        from_noreply = "noreply+readeck@${data.pubnet}";
      };
      auth.forwarded = {
        enabled = true;
        provisioning = false;
        header_user = "X-Webauth-User";
        header_email = "X-Webauth-Email";
      };
    };
  };

  services.caddy.virtualHosts = {
    "read.${data.tailnet}" = {
      extraConfig = ''
        bind tailscale/read
        tls {
          get_certificate tailscale
        }
        tailscale_auth
        reverse_proxy {
          to unix//run/web/readeck.sock
          header_up X-Webauth-User {http.auth.user.tailscale_login}
          header_up X-Webauth-Email {http.auth.user.tailscale_user}
        }
      '';
    };
  };

  systemd.services.readeck.serviceConfig = {
    SupplementaryGroups = [ "webservice" ];
  };
}