{ self, config, lib, pkgs, ... }: { age.secrets.freshrss-dbpass.file = "${self}/secrets/freshrss-dbpass.age"; age.secrets.freshrss-dbpass.owner = "freshrss"; services.freshrss = { enable = true; virtualHost = "rss.sealight.xyz"; baseUrl = "https://rss.sealight.xyz/"; passwordFile = "/run/agenix/freshrss-dbpass"; database = { type = "pgsql"; passFile = "/run/agenix/freshrss-dbpass"; port = 5432; }; }; services.postgresql = { enable = true; # Ensure postgresql is enabled # authentication = '' # local freshrss all ident map=freshrss-users # ''; # identMap = # Map the freshrss user to postgresql # '' # freshrss-users freshrss freshrss # freshrss-users postgres freshrss # ''; ensureDatabases = [ "freshrss" ]; ensureUsers = [{ name = "freshrss"; ensureDBOwnership = true; }]; # TODO # initialScript # set password for freshrss user }; services.nginx.virtualHosts."rss.sealight.xyz" = { enableACME = true; forceSSL = true; }; networking.firewall.allowedTCPPorts = [ 80 443 ]; security.acme.defaults.email = "anish+acme@lakhwara.com"; security.acme.acceptTerms = true; }