@@ -35,6 +35,7 @@ ../roles/reverse-proxy.nix
     ../roles/binary-cache.nix
     ../roles/forgejo-runner.nix
     ../roles/goatcounter.nix
+    ../roles/readeck.nix
     ../roles/searchix.nix
     ../roles/sso.nix
     ../settings/services/git-server.nix
@@ -56,7 +57,6 @@ redis-website.file = ../../secrets/redis-website.age;
     cifs-jellyfin.file = ../../secrets/cifs-jellyfin.age;
     cifs-paperless.file = ../../secrets/cifs-paperless.age;
     ntfy.file = ../../secrets/ntfy.age;
-    readeck.file = ../../secrets/readeck.age;
     open-webui.file = ../../secrets/open-webui.age;
   };
 
@@ -493,17 +493,6 @@ extraConfig = ''
             reverse_proxy ${config.services.ntfy-sh.settings.listen-http}
           '';
         };
-        "read.${ts-domain}" = {
-          extraConfig = ''
-            bind tailscale/read
-            tailscale_auth
-            reverse_proxy {
-              to unix//run/web/readeck.sock
-              header_up X-Webauth-User {http.auth.user.tailscale_login}
-              header_up X-Webauth-Email {http.auth.user.tailscale_user}
-            }
-          '';
-        };
         "papers.${ts-domain}" = {
           extraConfig = ''
             bind tailscale/papers
@@ -619,49 +608,6 @@ ];
 
       PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}";
       PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true;
-    };
-  };
-
-  systemd.services.readeck.serviceConfig = {
-    SupplementaryGroups = [ "webservice" ];
-  };
-
-  services.readeck = {
-    enable = true;
-    package = pkgs.readeck.overrideAttrs (attrs: rec {
-      version = "0.22.0-pre1";
-      src = pkgs.fetchFromCodeberg {
-        owner = "readeck";
-        repo = "readeck";
-        rev = "12e39b6fe20d3949b249b1410b83ea8ea5043046";
-        hash = "sha256-QOnxTUlC+TaU/MSDSIg8T3cc7dScojVGVyM7kltljbA=";
-      };
-
-      vendorHash = "sha256-2MB7v5oG/LcEKtgbFNxPXSI8TljpbqYUrI7pvu7m+e8=";
-
-      npmDeps = pkgs.fetchNpmDeps {
-        src = "${src}/web";
-        hash = "sha256-znUKRaUdx6GXD2YL6hs0iveaAAHQ8H9n4NHZFi331+g=";
-      };
-    });
-    environmentFile = config.age.secrets.readeck.path;
-    settings = {
-      server = {
-        host = "unix:/run/web/readeck.sock?mode=0660";
-        base_url = "https://read.${ts-domain}";
-      };
-      email = {
-        host = "localhost";
-        port = 587;
-        from = "readeck@${domain}";
-        from_noreply = "noreply+readeck@${domain}";
-      };
-      auth.forwarded = {
-        enabled = true;
-        provisioning = false;
-        header_user = "X-Webauth-User";
-        header_email = "X-Webauth-Email";
-      };
     };
   };
 

@@ -0,0 +1,69 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  domain = config.networking.domain;
+  ts-domain = "fin-marlin.ts.net";
+in
+{
+  age.secrets.readeck.file = ../../secrets/readeck.age;
+
+  services.readeck = {
+    enable = true;
+    package = pkgs.readeck.overrideAttrs (attrs: rec {
+      version = "0.22.0-pre1";
+      src = pkgs.fetchFromCodeberg {
+        owner = "readeck";
+        repo = "readeck";
+        rev = "12e39b6fe20d3949b249b1410b83ea8ea5043046";
+        hash = "sha256-QOnxTUlC+TaU/MSDSIg8T3cc7dScojVGVyM7kltljbA=";
+      };
+
+      vendorHash = "sha256-2MB7v5oG/LcEKtgbFNxPXSI8TljpbqYUrI7pvu7m+e8=";
+
+      npmDeps = pkgs.fetchNpmDeps {
+        src = "${src}/web";
+        hash = "sha256-znUKRaUdx6GXD2YL6hs0iveaAAHQ8H9n4NHZFi331+g=";
+      };
+    });
+    environmentFile = config.age.secrets.readeck.path;
+    settings = {
+      server = {
+        host = "unix:/run/web/readeck.sock?mode=0660";
+        base_url = "https://read.${ts-domain}";
+      };
+      email = {
+        host = "localhost";
+        port = 587;
+        from = "readeck@${domain}";
+        from_noreply = "noreply+readeck@${domain}";
+      };
+      auth.forwarded = {
+        enabled = true;
+        provisioning = false;
+        header_user = "X-Webauth-User";
+        header_email = "X-Webauth-Email";
+      };
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "read.${ts-domain}" = {
+      extraConfig = ''
+        bind tailscale/read
+        tailscale_auth
+        reverse_proxy {
+          to unix//run/web/readeck.sock
+          header_up X-Webauth-User {http.auth.user.tailscale_login}
+          header_up X-Webauth-Email {http.auth.user.tailscale_user}
+        }
+      '';
+    };
+  };
+
+  systemd.services.readeck.serviceConfig = {
+    SupplementaryGroups = [ "webservice" ];
+  };
+}