add miniflux server for Cape

nixos/configurations/Cape/default.nix

@@ -10,6 +10,7 @@
     ./hardware-configuration.nix
     ./users
     ./disko-config.nix
+    ./miniflux.nix
   ];
 
   youthlic = {

nixos/configurations/Cape/miniflux.nix

@@ -0,0 +1,17 @@
+{ config, ... }:
+{
+  sops.secrets."miniflux" = {
+  };
+  youthlic.containers.miniflux = {
+    enable = true;
+    interface = "ens3";
+    adminCredentialsFile = config.sops.secrets."miniflux".path;
+  };
+  services.caddy.virtualHosts = {
+    "miniflux.${config.youthlic.programs.caddy.baseDomain}" = {
+      extraConfig = ''
+        reverse_proxy 10.231.137.102:8485
+      '';
+    };
+  };
+}

nixos/modules/containers/default.nix

@@ -2,5 +2,6 @@
 {
   imports = [
     ./forgejo.nix
+    ./miniflux.nix
   ];
 }

nixos/modules/containers/miniflux.nix

@@ -0,0 +1,107 @@
+{ config, lib, ... }:
+let
+  cfg = config.youthlic.containers.miniflux;
+in
+{
+  options = {
+    youthlic.containers.miniflux = {
+      enable = lib.mkEnableOption "miniflux container";
+      adminCredentialsFile = lib.mkOption {
+        type = lib.types.nonEmptyStr;
+      };
+      interface = lib.mkOption {
+        type = lib.types.nonEmptyStr;
+        example = "ens3";
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    networking.nat = {
+      enable = true;
+      internalInterfaces = [ "ve-+" ];
+      externalInterface = cfg.interface;
+      enableIPv6 = true;
+    };
+    containers."miniflux" = {
+      ephemeral = true;
+      autoStart = true;
+      privateNetwork = true;
+      hostAddress = "10.231.137.1";
+      localAddress = "10.231.137.102";
+      bindMounts = {
+        "/var/lib/miniflux" = {
+          hostPath = "/mnt/containers/miniflux/state";
+          isReadOnly = false;
+        };
+        "/var/lib/postgresql" = {
+          hostPath = "/mnt/containers/miniflux/database";
+          isReadOnly = false;
+        };
+        "${cfg.adminCredentialsFile}" = {
+          isReadOnly = true;
+        };
+      };
+      forwardPorts = [
+        {
+          containerPort = 8485;
+          hostPort = 8485;
+          protocol = "tcp";
+        }
+        {
+          containerPort = 8485;
+          hostPort = 8485;
+          protocol = "udp";
+        }
+      ];
+
+      config =
+        { lib, ... }:
+        {
+          imports = [
+            ./../programs/miniflux.nix
+            ./../programs/postgresql.nix
+          ];
+
+          systemd.tmpfiles.rules = [
+            "d /var/lib/miniflux 770 miniflux miniflux -"
+            "d /var/lib/postgresql 770 postgres postgres -"
+            "d /run/secrets 770 root miniflux -"
+          ];
+
+          youthlic.programs = {
+            miniflux = {
+              enable = true;
+              database = {
+                user = "miniflux";
+              };
+              adminCredentialsFile = cfg.adminCredentialsFile;
+            };
+            postgresql = {
+              enable = true;
+              database = "miniflux";
+              auth_method = "peer";
+              version = "17";
+            };
+          };
+
+          systemd.services.miniflux = {
+            wants = [ "postgresql.service" ];
+            requires = [ "postgresql.service" ];
+            after = [ "postgresql.service" ];
+            wantedBy = [ "default.target" ];
+          };
+
+          networking = {
+            firewall = {
+              enable = true;
+              allowedTCPPorts = [ 8485 ];
+              allowedUDPPorts = [ 8485 ];
+            };
+            useHostResolvConf = lib.mkForce false;
+          };
+          services.resolved.enable = true;
+          system.stateVersion = "24.11";
+        };
+    };
+  };
+}

nixos/modules/programs/default.nix

@@ -19,5 +19,6 @@
     ./conduwuit.nix
     ./nix-ld.nix
     ./juicity
+    ./miniflux.nix
   ];
 }

nixos/modules/programs/miniflux.nix

@@ -0,0 +1,48 @@
+{ lib, config, ... }:
+let
+  cfg = config.youthlic.programs.miniflux;
+in
+{
+  options = {
+    youthlic.programs.miniflux = {
+      enable = lib.mkEnableOption "miniflux";
+      adminCredentialsFile = lib.mkOption {
+        type = lib.types.path;
+      };
+      database = {
+        user = lib.mkOption {
+          type = lib.types.nonEmptyStr;
+          example = "miniflux";
+        };
+        socket = lib.mkOption {
+          type = lib.types.nonEmptyStr;
+          default = "/run/postgresql";
+        };
+      };
+    };
+  };
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      services.miniflux = {
+        enable = true;
+        config = {
+          LISTEN_ADDR = "0.0.0.0:8485";
+          DATABASE_URL = "user=${cfg.database.user} host=${cfg.database.socket} dbname=miniflux";
+          CREATE_ADMIN = 1;
+          WATCHDOG = 1;
+        };
+        createDatabaseLocally = false;
+        adminCredentialsFile = cfg.adminCredentialsFile;
+      };
+    })
+    (lib.mkIf (cfg.enable && config.youthlic.programs.caddy.enable) {
+      services.caddy.virtualHosts = {
+        "miniflux.${config.youthlic.programs.caddy.baseDomain}" = {
+          extraConfig = ''
+            reverse_proxy 127.0.0.1:8485
+          '';
+        };
+      };
+    })
+  ];
+}