server-configs/machines/gerd/services/miniflux.nix

{ config, lib, pkgs, ... }:

let
  svc_domain = "miniflux.${config.mine.shared.settings.domain}";
  port = 6466;

  listenOn = "localhost:${builtins.toString port}";
  httpListenOn = "http://${listenOn}";
in {
  services.miniflux = {
    enable = true;

    config = {
      # listen only on localhost
      LISTEN_ADDR = listenOn;

      # setup the correct baseurl
      BASE_URL = "https://${svc_domain}";

      # disable admin account, disable local auth
      CREATE_ADMIN = 0;
      DISABLE_LOCAL_AUTH = "true";

      # use auth proxy
      AUTH_PROXY_HEADER = config.mine.shared.lib.authelia.protectedHeaders.username;
      AUTH_PROXY_USER_CREATION = "true";

      # For privacy, proxy images instead of hotlinking
      MEDIA_PROXY_RESOURCE_TYPES = "image,audio,video";
      MEDIA_PROXY_MODE = "all";
    };
  };

  # nginx
  services.nginx.virtualHosts."${svc_domain}" = config.mine.shared.lib.authelia.mkProtectedWebsite {
    forceSSL = true;
    enableACME = true;
    
    locations."/" = config.mine.shared.lib.authelia.mkProtectedLocation {
      proxyPass = httpListenOn;
    };

    # allow API for mobile apps etc.
    locations."/v1".proxyPass = httpListenOn;

    # allow sharing
    locations."/share".proxyPass = httpListenOn;

    # used for sharing
    # TODO: would be nice if nginx could serve this instead
    locations."~* \.(js|jpg|png|css)$".proxyPass = httpListenOn;
  };

  # meta
  mine.shared.meta.miniflux = {
    name = "Miniflux";
    description = "We host our own miniflux, use it to read all your feeds!";
    url = "https://${svc_domain}";

    package = let
      pkg = config.services.miniflux.package;
    in {
      name = pkg.pname;
      version = pkg.version;
      meta = pkg.meta;
    };
  };
}