helm/hosts/profiles/wallabag/default.nix

{ self, pkgs, config, lib, ... }:

{
  age.secrets.wallabag-password.file = "${self}/secrets/wallabag-password.age";
  age.secrets.wallabag-secret.file = "${self}/secrets/wallabag-secret.age";
  age.secrets.wallabag-password.owner = "wallabag";
  age.secrets.wallabag-secret.owner = "wallabag";
  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_15;

    # Ensure the database, user, and permissions always exist
    ensureDatabases = [ "wallabag" ];
    ensureUsers = [
      {
        name = "wallabag";
        # ensureDBOwnership = true;
      }
    ];
    authentication = ''
      local wallabag all peer
    '';
  };

  services.wallabag = {
    enable = true;
    domain = "read.mossnet.lan";
    virtualHost.enable = true;
    package = pkgs.my-wallabag;
    # Systemd now defaults to /var/lib?
    # dataDir = "/var/lib/wallabag";
    parameters = {
      "env(SECRET_FILE)" = config.age.secrets.wallabag-secret.path;
      secret = "%env(file:resolve:SECRET_FILE)%";
    };
  };
}