diff --git a/flake.lock b/flake.lock index 18bc38a..d78098f 100644 --- a/flake.lock +++ b/flake.lock @@ -2,11 +2,11 @@ "nodes": { "catppuccin": { "locked": { - "lastModified": 1722661201, - "narHash": "sha256-2JX3S1hmmUhHuyGyGWnaM4xT0SiaDdVkNzmBrEowwK0=", + "lastModified": 1721784420, + "narHash": "sha256-bgF6fN4Qgk7NErFKGuuqWXcLORsiykTYyqMUFRiAUBY=", "owner": "catppuccin", "repo": "nix", - "rev": "19a0f144f0204a12a89243363efb6a493b8cfc83", + "rev": "8bdb55cc1c13f572b6e4307a3c0d64f1ae286a4f", "type": "github" }, "original": { @@ -99,11 +99,11 @@ ] }, "locked": { - "lastModified": 1722630065, - "narHash": "sha256-QfM/9BMRkCmgWzrPDK+KbgJOUlSJnfX4OvsUupEUZvA=", + "lastModified": 1722462338, + "narHash": "sha256-ss0G8t8RJVDewA3MyqgAlV951cWRK6EtVhVKEZ7J5LU=", "owner": "nix-community", "repo": "home-manager", - "rev": "afc892db74d65042031a093adb6010c4c3378422", + "rev": "6e090576c4824b16e8759ebca3958c5b09659ee8", "type": "github" }, "original": { @@ -119,11 +119,11 @@ ] }, "locked": { - "lastModified": 1722740924, - "narHash": "sha256-UQPgA5d8azLZuDHZMPmvDszhuKF1Ek89SrTRtqsQ4Ss=", + "lastModified": 1722136042, + "narHash": "sha256-x3FmT4QSyK28itMiR5zfYhUrG5nY+2dv+AIcKfmSp5A=", "owner": "Mic92", "repo": "nix-index-database", - "rev": "97ca0a0fca0391de835f57e44f369a283e37890f", + "rev": "c0ca47e8523b578464014961059999d8eddd4aae", "type": "github" }, "original": { @@ -143,11 +143,11 @@ ] }, "locked": { - "lastModified": 1722821408, - "narHash": "sha256-FMCo35ZmMfvAcae+9neKfu6QzXjU3WL6vW2OFMXx6wI=", + "lastModified": 1722476581, + "narHash": "sha256-dCNcvjaOTu+cPin3VUym9pglsghWYJe5oUpKTuAgiiU=", "owner": "nix-community", "repo": "nix-vscode-extensions", - "rev": "f25962fbd632afea744dc7e6868f24d2e73ccedb", + "rev": "1fe57eaf074d28246ec310486fe3db4ae44d0451", "type": "github" }, "original": { @@ -174,11 +174,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1722578639, - "narHash": "sha256-yge4OI8r8JBFtoajezauguXwYJ7M+Enwb3ZGbJF4YKA=", + "lastModified": 1722489601, + "narHash": "sha256-sB37J92AwEcmzg0GgxdI1TU6M+psUpbo0iYLFJBmsfo=", "owner": "xinyangli", "repo": "nixpkgs", - "rev": "4c71f761584bd9f9a4c4ba090c353c7f3e65c430", + "rev": "eee3d54e62749dfd0f263e3903ca0ec1ebdbe72b", "type": "github" }, "original": { @@ -190,11 +190,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1722651103, - "narHash": "sha256-IRiJA0NVAoyaZeKZluwfb2DoTpBAj+FLI0KfybBeDU0=", + "lastModified": 1722221733, + "narHash": "sha256-sga9SrrPb+pQJxG1ttJfMPheZvDOxApFfwXCFO0H9xw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "a633d89c6dc9a2a8aae11813a62d7c58b2c0cc51", + "rev": "12bf09802d77264e441f48e25459c10c93eada2e", "type": "github" }, "original": { @@ -222,11 +222,11 @@ }, "nur": { "locked": { - "lastModified": 1722859145, - "narHash": "sha256-Y0X6yzkq5hU/A8MlC9/DfMz1i6mXEauD9539xUkEvo8=", + "lastModified": 1722485061, + "narHash": "sha256-opkrX6noshjk2V3PKBiksA8+M6K7cu3EuiuAWL04pNs=", "owner": "nix-community", "repo": "NUR", - "rev": "ef567c82705d29b0b32d63ffd006c56c92953f4d", + "rev": "3bf06551d5922d420607091f5a3321e712ece307", "type": "github" }, "original": { diff --git a/machines/massicot/secrets.yaml b/machines/massicot/secrets.yaml index b5ca7fe..fb88246 100644 --- a/machines/massicot/secrets.yaml +++ b/machines/massicot/secrets.yaml @@ -3,7 +3,7 @@ gts_env: ENC[AES256_GCM,data:CKFKHXCJvTD0HFkVrBWhabcl/cloCT03qcZIc5JymiIAu+o6wef hedgedoc_env: ENC[AES256_GCM,data:zwAA+zKSJT0tZyYArCaa1lfL0y8DNHDp/thS11DrVxNvjmk38o0ydsKArfZKzFYye+qNBzz1B4sPCdW4cFgQUNgbM+n9AvoMB8CssdmQ+sALKmozA5aEV23q+khZSGlHocP6WA==,iv:SgZruOS1nanK64Ex1dvgoD1HzbGbNa4DFSBuVoaNgEc=,tag:R+I8m1AloDCXs5PdpEpS0w==,type:str] grafana_oauth_secret: ENC[AES256_GCM,data:2dSgxeWXNtlvbrgW9whCVuM6tfzd4lVhynwQTSPbBJndhI8scpJle7LjI1+b14FS9boBsuYO+ym4Pf1I8/jJtKkj6X6I0BmXFBC/SfpCpo+ZGrxacg==,iv:N8iTPqMagKP3hWc7n0bjgYKvaFaw11ITvDn9lUkkAPY=,tag:Cz59fA2Zq3jVvhfxaFuGAA==,type:str] miniflux: - oauth2_secret: ENC[AES256_GCM,data:Q0JeT5VHGEDATXB9jf5+eU1Hoi9FsJrw6IK2T0bodvVgki+1oF+sWld5NGpoiXm/bQ==,iv:e8+84Zk5eXNIyIPhTG8jFhO+DCRorPFG0lDDNT4OxCs=,tag:IxlyFBcFaSy7Nz0aQCH3bw==,type:str] + oauth2_secret: ENC[AES256_GCM,data:ktwQgPwcXTmMFhiTjXUGmPysfSg6X+EFBbfZMQ==,iv:vYF86NFW1EGf1TYLicTGiTIRKP/XC914zmVm42SyWPc=,tag:E1BdVp35362X373EE1HKvg==,type:str] sops: kms: [] gcp_kms: [] @@ -28,8 +28,8 @@ sops: dnFBa0lDWWZtS1BHdzBoVzNTaGNkSEEKi/W1n7RT8NpTp00SBMwxsUJAPDhumJ/i V2VnaSNwouD3SswTcoBzqQpBP9XrqzjIYGke90ZODFQbMY9WDQ+O0g== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-08-05T08:53:56Z" - mac: ENC[AES256_GCM,data:DtAL9k/t4pGV2UqCrb1R/1nT3gjJ8wced5yQOF5oneoncg/uuyX7IDZ0iZz0eGirj9Zadh9UQWNwxMzoiNu6pD1v04MkxT0NVDJ32vt5X+YDQJ60vRJjn9+zKvLk8Esx9sFsuBxjVXXmbtev7+djU+LbpPLfaobdheO2XlJXtdU=,iv:y2KI5ylgvuQ7ktYAr6XPEX3qyxnSP7BWC79mdsr4hgk=,tag:cvXvXeKvRwvttgQfmZRi2w==,type:str] + lastmodified: "2024-08-05T07:07:04Z" + mac: ENC[AES256_GCM,data:1/PFLb8fgNgBz4YZDqNUxw5JMzt+ATD1wuFWNwJkVGVlXgLpSuOYZc5TYte3W8HTLDY8YOFYdcZtvDyjeFf7PAGxAVhqE1TgAfs0HxEHY3S8Ivcen86LTmcsiPy1frGHOLhzFfim3GRLyNA+MUFzCSLCbERJ0t0iK+L0EZ9SoyY=,iv:+DeQvoP3xBBEkv0IaQ5R0EFtQ/19bKSG/eRrDp4JPJs=,tag:Xz3sSbS07rcNaoImy10P5A==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.9.0 diff --git a/machines/massicot/services.nix b/machines/massicot/services.nix index 96ede16..7989aeb 100644 --- a/machines/massicot/services.nix +++ b/machines/massicot/services.nix @@ -29,7 +29,6 @@ in custom.prometheus = { enable = true; exporters.blackbox.enable = true; - exporters.miniflux.enable = true; }; systemd.mounts = map @@ -90,14 +89,13 @@ in custom.miniflux = { enable = true; environment = { - LOG_LEVEL = "debug"; LISTEN_ADDR = "127.0.0.1:58173"; - BASE_URL = "https://rss.xinyang.life/"; OAUTH2_PROVIDER = "oidc"; - OAUTH2_CLIENT_ID = "miniflux"; + OAUTH2_CLIEND_ID = "miniflux"; OAUTH2_REDIRECT_URL = "https://rss.xinyang.life/oauth2/oidc/callback"; OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.xinyang.life/oauth2/openid/miniflux"; OAUTH2_USER_CREATION = 1; + CREATE_ADMIN = lib.mkForce ""; }; oauth2SecretFile = config.sops.secrets."miniflux/oauth2_secret".path; }; @@ -257,7 +255,7 @@ in ''; virtualHosts."https://rss.xinyang.life".extraConfig = '' - reverse_proxy ${config.custom.miniflux.environment.LISTEN_ADDR} + reverse_proxy ${config.services.miniflux.config.LISTEN_ADDR} ''; virtualHosts."https://ntfy.xinyang.life".extraConfig = '' diff --git a/modules/nixos/miniflux.nix b/modules/nixos/miniflux.nix index 2d539e0..9fcb8ad 100644 --- a/modules/nixos/miniflux.nix +++ b/modules/nixos/miniflux.nix @@ -1,133 +1,36 @@ { config, pkgs, lib, ... }: let - inherit (lib) mkEnableOption mkPackageOption mkOption types literalExpression mkIf mkDefault; + inherit (lib) mkEnableOption mkOption types; cfg = config.custom.miniflux; - - defaultAddress = "localhost:8080"; - - pgbin = "${config.services.postgresql.package}/bin"; - preStart = pkgs.writeScript "miniflux-pre-start" '' - #!${pkgs.runtimeShell} - ${pgbin}/psql "miniflux" -c "CREATE EXTENSION IF NOT EXISTS hstore" - ''; in { options = { custom.miniflux = { enable = mkEnableOption "miniflux"; - - package = mkPackageOption pkgs "miniflux" { }; - oauth2SecretFile = mkOption { type = types.path; }; - + environmentFile = mkOption { + type = types.path; + default = "/dev/null"; + }; environment = mkOption { type = with types; attrsOf (oneOf [ int str ]); }; - - createDatabaseLocally = mkOption { - type = types.bool; - default = true; - description = '' - Whether a PostgreSQL database should be automatically created and - configured on the local host. If set to `false`, you need provision a - database yourself and make sure to create the hstore extension in it. - ''; - }; }; }; config = lib.mkIf cfg.enable { - services.miniflux.enable = false; - custom.miniflux.environment = { - LISTEN_ADDR = mkDefault defaultAddress; - RUN_MIGRATIONS = mkDefault 1; - DATABASE_URL = lib.mkIf cfg.createDatabaseLocally "user=miniflux host=/run/postgresql dbname=miniflux"; - OAUTH2_CLIENT_SECRET_FILE = "%d/oauth2_secret"; - WATCHDOG = mkDefault 1; - }; - - services.postgresql = lib.mkIf cfg.createDatabaseLocally { + services.miniflux = { enable = true; - ensureUsers = [{ - name = "miniflux"; - ensureDBOwnership = true; - }]; - ensureDatabases = [ "miniflux" ]; + adminCredentialsFile = cfg.environmentFile; }; - - systemd.services.miniflux-dbsetup = lib.mkIf cfg.createDatabaseLocally { - description = "Miniflux database setup"; - requires = [ "postgresql.service" ]; - after = [ "network.target" "postgresql.service" ]; - serviceConfig = { - Type = "oneshot"; - User = config.services.postgresql.superUser; - ExecStart = preStart; - }; - }; - systemd.services.miniflux = { - description = "Miniflux service"; - wantedBy = [ "multi-user.target" ]; - requires = lib.optional cfg.createDatabaseLocally "miniflux-dbsetup.service"; - after = [ "network.target" ] - ++ lib.optionals cfg.createDatabaseLocally [ "postgresql.service" "miniflux-dbsetup.service" ]; - serviceConfig = { - Type = "notify"; - ExecStart = lib.getExe cfg.package; - User = "miniflux"; - DynamicUser = true; LoadCredential = [ "oauth2_secret:${cfg.oauth2SecretFile}" ]; - RuntimeDirectory = "miniflux"; - RuntimeDirectoryMode = "0750"; - WatchdogSec = 60; - WatchdogSignal = "SIGKILL"; - Restart = "always"; - RestartSec = 5; - - # Hardening - CapabilityBoundingSet = [ "" ]; - DeviceAllow = [ "" ]; - LockPersonality = true; - MemoryDenyWriteExecute = true; - PrivateDevices = true; - PrivateUsers = true; - ProcSubset = "pid"; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectProc = "invisible"; - RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; - RestrictNamespaces = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - SystemCallArchitectures = "native"; - SystemCallFilter = [ "@system-service" "~@privileged" ]; - UMask = "0077"; + EnvironmentFile = [ "%d/oauth2_secret" ]; }; - - environment = lib.mapAttrs (_: toString) cfg.environment; + environment = lib.mapAttrs (_: lib.mkForce) (lib.mapAttrs (_: toString) cfg.environment); }; - environment.systemPackages = [ cfg.package ]; - - security.apparmor.policies."bin.miniflux".profile = '' - include - ${cfg.package}/bin/miniflux { - include - include - include - include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}" - r ${cfg.package}/bin/miniflux, - r @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size, - rw /run/miniflux/**, - } - ''; }; } diff --git a/modules/nixos/prometheus/default.nix b/modules/nixos/prometheus/default.nix index a560737..8c43908 100644 --- a/modules/nixos/prometheus/default.nix +++ b/modules/nixos/prometheus/default.nix @@ -29,7 +29,6 @@ in ./caddy.nix ./gotosocial.nix ./immich.nix - ./miniflux.nix ./ntfy-sh.nix ./restic.nix ]; @@ -49,8 +48,7 @@ in caddy.enable = mkExporterOption config.services.caddy.enable; gotosocial.enable = mkExporterOption config.services.gotosocial.enable; immich.enable = mkExporterOption config.services.immich.enable; - miniflux.enable = mkExporterOption config.services.miniflux.enable; - ntfy-sh.enable = mkExporterOption config.services.ntfy-sh.enable; + ntfy-sh.enable = mkExporterOption config.services.gotosocial.enable; }; grafana = { enable = mkEnableOption "Grafana Cloud"; @@ -96,11 +94,11 @@ in node = { enable = true; enabledCollectors = [ + "diskstats" "loadavg" "time" "systemd" ]; - listenAddress = "127.0.0.1"; port = 9100; }; }; diff --git a/modules/nixos/prometheus/miniflux.nix b/modules/nixos/prometheus/miniflux.nix deleted file mode 100644 index 5339de3..0000000 --- a/modules/nixos/prometheus/miniflux.nix +++ /dev/null @@ -1,17 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.custom.prometheus; -in -{ - config = lib.mkIf (cfg.enable && cfg.exporters.miniflux.enable) { - systemd.services.miniflux.environment.METRICS_COLLECTOR = "1"; - services.prometheus.scrapeConfigs = [ - { - job_name = "miniflux"; - static_configs = [ - { targets = [ config.systemd.services.miniflux.environment.LISTEN_ADDR ]; } - ]; - } - ]; - }; -}