From 12875ff89129f566a359dfc19339b3397f65379a Mon Sep 17 00:00:00 2001
From: Anish Lakhwara <anish+git@lakhwara.com>
Date: Wed, 7 Dec 2022 22:30:25 +1000
Subject: [PATCH] houston, we have freshrss

---
 flake.nix                           |  1 +
 hosts/curve/default.nix             |  2 +-
 hosts/profiles/freshrss/default.nix | 14 +++++++++-----
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/flake.nix b/flake.nix
index b48ce502..c4e508d1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -247,6 +247,7 @@
         };
         helix = {
           hostname = "git.sealight.xyz";
+          autoRollback = false;
           profiles.system = {
             user = "root";
             path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix;
diff --git a/hosts/curve/default.nix b/hosts/curve/default.nix
index 8833b39c..c1d31ffb 100644
--- a/hosts/curve/default.nix
+++ b/hosts/curve/default.nix
@@ -24,7 +24,7 @@
     services.NetworkManager-wait-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["network-online.target"]
   };
 
-  programs.gnupg.agent.pinentryFlavor = "gnome3";
+  programs.gnupg.agent.pinentryFlavor = "gtk2";
 
   fileSystems."/mnt/ftp" = {
     device = "192.168.1.240:/home/ftp";
diff --git a/hosts/profiles/freshrss/default.nix b/hosts/profiles/freshrss/default.nix
index f5447dfe..46c6ec19 100644
--- a/hosts/profiles/freshrss/default.nix
+++ b/hosts/profiles/freshrss/default.nix
@@ -11,6 +11,7 @@
     database = {
       type = "pgsql";
       passFile = "/run/agenix/freshrss-dbpass";
+      port = 5432;
     };
   };
 
@@ -20,15 +21,18 @@
     authentication = ''
       local freshrss all ident map=freshrss-users
     '';
-    identMap = # Map the gitea user to postgresql
+    identMap = # Map the freshrss user to postgresql
       ''
         freshrss-users freshrss freshrss
       '';
-    # TODO with password
     ensureDatabases = [ "freshrss" ];
-    ensureUsers = [
-      { name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; }
-    ];
+    # TODO
+    # initialScript # set password for gitea user
+  };
+
+  services.nginx.virtualHosts."rss.sealight.xyz" = {
+    enableACME = true;
+    forceSSL = true;
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];