92 lines
2.3 KiB
Nix
92 lines
2.3 KiB
Nix
{ config, lib, ... }:
|
|
{
|
|
sops.secrets.shlink-db-password = {
|
|
sopsFile = ../../secrets/shlink.yaml;
|
|
owner = "postgres";
|
|
};
|
|
|
|
sops.secrets.shlink-api-key = {
|
|
sopsFile = ../../secrets/shlink.yaml;
|
|
};
|
|
|
|
sops.templates.shlink-env = {
|
|
content = ''
|
|
INITIAL_API_KEY=${config.sops.placeholder.shlink-api-key}
|
|
DB_PASSWORD=${config.sops.placeholder.shlink-db-password}
|
|
'';
|
|
owner = "podman";
|
|
};
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureDatabases = [ "shlink" ];
|
|
ensureUsers = [{
|
|
name = "shlink";
|
|
ensureDBOwnership = true;
|
|
}];
|
|
authentication = ''
|
|
host shlink shlink 127.0.0.1/32 md5
|
|
host shlink shlink ::1/128 md5
|
|
'';
|
|
};
|
|
|
|
systemd.services.postgresql.postStart = lib.mkAfter ''
|
|
$PSQL -tA <<'EOF'
|
|
DO $$
|
|
DECLARE pw TEXT;
|
|
BEGIN
|
|
pw := trim(both from pg_read_file('${config.sops.secrets.shlink-db-password.path}'));
|
|
EXECUTE format('ALTER USER shlink PASSWORD %L', pw);
|
|
END
|
|
$$;
|
|
EOF
|
|
'';
|
|
|
|
services.caddy.virtualHosts."ily.rs" = {
|
|
extraConfig = ''
|
|
redir / https://wynne.rs permanent
|
|
reverse_proxy localhost:8080
|
|
encode zstd gzip
|
|
'';
|
|
};
|
|
|
|
services.caddy.virtualHosts."links.ily.rs" = {
|
|
extraConfig = ''
|
|
import tinyauth
|
|
reverse_proxy localhost:8081
|
|
encode zstd gzip
|
|
'';
|
|
};
|
|
|
|
virtualisation.oci-containers.containers.shlink = {
|
|
image = "shlinkio/shlink:4.4.0";
|
|
podman.user = "podman";
|
|
ports = [ "127.0.0.1:8080:8080" ];
|
|
environment = {
|
|
DEFAULT_DOMAIN = "ily.rs";
|
|
IS_HTTPS_ENABLED = "true";
|
|
DB_DRIVER = "postgres";
|
|
DB_HOST = "host.containers.internal";
|
|
DB_NAME = "shlink";
|
|
DB_USER = "shlink";
|
|
PORT = "8080";
|
|
};
|
|
environmentFiles = [ config.sops.templates.shlink-env.path ];
|
|
};
|
|
|
|
# Workaround for NixOS/nixpkgs#410857 until backport of #475089 lands
|
|
systemd.services.podman-shlink = {
|
|
after = [ "postgresql.service" ];
|
|
requires = [ "postgresql.service" ];
|
|
serviceConfig.Delegate = true;
|
|
};
|
|
|
|
virtualisation.oci-containers.containers.shlink-web-client = {
|
|
image = "shlinkio/shlink-web-client:4.3.1";
|
|
podman.user = "podman";
|
|
ports = [ "127.0.0.1:8081:8080" ];
|
|
};
|
|
|
|
# Workaround for NixOS/nixpkgs#410857 until backport of #475089 lands
|
|
systemd.services.podman-shlink-web-client.serviceConfig.Delegate = true;
|
|
}
|