houston, we have freshrss

flake.nix

@@ -247,6 +247,7 @@
         };
         helix = {
           hostname = "git.sealight.xyz";
+          autoRollback = false;
           profiles.system = {
             user = "root";
             path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix;

hosts/curve/default.nix

@@ -24,7 +24,7 @@
     services.NetworkManager-wait-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["network-online.target"]
   };
 
-  programs.gnupg.agent.pinentryFlavor = "gnome3";
+  programs.gnupg.agent.pinentryFlavor = "gtk2";
 
   fileSystems."/mnt/ftp" = {
     device = "192.168.1.240:/home/ftp";

hosts/profiles/freshrss/default.nix

@@ -11,6 +11,7 @@
     database = {
       type = "pgsql";
       passFile = "/run/agenix/freshrss-dbpass";
+      port = 5432;
     };
   };
 
@@ -20,15 +21,18 @@
     authentication = ''
       local freshrss all ident map=freshrss-users
     '';
-    identMap = # Map the gitea user to postgresql
+    identMap = # Map the freshrss user to postgresql
       ''
         freshrss-users freshrss freshrss
       '';
-    # TODO with password
     ensureDatabases = [ "freshrss" ];
-    ensureUsers = [
-      { name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; }
-    ];
+    # TODO
+    # initialScript # set password for gitea user
+  };
+
+  services.nginx.virtualHosts."rss.sealight.xyz" = {
+    enableACME = true;
+    forceSSL = true;
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];