From 9d44f6eb07cb2d2129b84f5c3fd613a953dd7177 Mon Sep 17 00:00:00 2001
From: xinyangli <lixinyang411@gmail.com>
Date: Mon, 5 Aug 2024 10:52:54 +0800
Subject: [PATCH] modules/miniflux: handle oauth2 secret with LoadCredential

---
 machines/massicot/default.nix  |  4 +---
 machines/massicot/secrets.yaml |  5 +++--
 machines/massicot/services.nix |  6 +++---
 modules/nixos/default.nix      |  1 +
 modules/nixos/miniflux.nix     | 36 ++++++++++++++++++++++++++++++++++
 5 files changed, 44 insertions(+), 8 deletions(-)
 create mode 100644 modules/nixos/miniflux.nix

diff --git a/machines/massicot/default.nix b/machines/massicot/default.nix
index ab45a34..06f9fcf 100644
--- a/machines/massicot/default.nix
+++ b/machines/massicot/default.nix
@@ -28,9 +28,7 @@
       grafana_oauth_secret = {
         owner = "grafana";
       };
-      miniflux_oauth_secret = {
-        owner = "miniflux";
-      };
+      "miniflux/oauth2_secret" = { };
     };
   };
 
diff --git a/machines/massicot/secrets.yaml b/machines/massicot/secrets.yaml
index c1dbf8e..64dee73 100644
--- a/machines/massicot/secrets.yaml
+++ b/machines/massicot/secrets.yaml
@@ -2,6 +2,7 @@ storage_box_mount: ENC[AES256_GCM,data:9lOAL3tkfB0pN4/cuM4SX0xoMrW0UUEzTN8spw3MQ
 gts_env: ENC[AES256_GCM,data:CKFKHXCJvTD0HFkVrBWhabcl/cloCT03qcZIc5JymiIAu+o6wef6gsQlkKP81vxC9S3XMYtLgXQ03D7Jetkfg+7nafF1+ogN,iv:/axRqZIatwYL++/KmBIievPPyKRkHGmVpgRe2Eet+fg=,tag:gwxyuePOYiD1vlSyq3yjXA==,type:str]
 hedgedoc_env: ENC[AES256_GCM,data:zwAA+zKSJT0tZyYArCaa1lfL0y8DNHDp/thS11DrVxNvjmk38o0ydsKArfZKzFYye+qNBzz1B4sPCdW4cFgQUNgbM+n9AvoMB8CssdmQ+sALKmozA5aEV23q+khZSGlHocP6WA==,iv:SgZruOS1nanK64Ex1dvgoD1HzbGbNa4DFSBuVoaNgEc=,tag:R+I8m1AloDCXs5PdpEpS0w==,type:str]
 grafana_oauth_secret: ENC[AES256_GCM,data:2dSgxeWXNtlvbrgW9whCVuM6tfzd4lVhynwQTSPbBJndhI8scpJle7LjI1+b14FS9boBsuYO+ym4Pf1I8/jJtKkj6X6I0BmXFBC/SfpCpo+ZGrxacg==,iv:N8iTPqMagKP3hWc7n0bjgYKvaFaw11ITvDn9lUkkAPY=,tag:Cz59fA2Zq3jVvhfxaFuGAA==,type:str]
+miniflux: ENC[AES256_GCM,data:26/dYh3jrcqIxmo2WSy1tz54BQQAQg==,iv:yv7dS/RcsitYb/7firhr5lcy1TUDMuFRpwk6WaPHOKk=,tag:FdJcvBCL96GqG3uB41i6Ng==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -26,8 +27,8 @@ sops:
             dnFBa0lDWWZtS1BHdzBoVzNTaGNkSEEKi/W1n7RT8NpTp00SBMwxsUJAPDhumJ/i
             V2VnaSNwouD3SswTcoBzqQpBP9XrqzjIYGke90ZODFQbMY9WDQ+O0g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-07-31T09:24:12Z"
-    mac: ENC[AES256_GCM,data:/TIuK0O0e3Kkb9yjVE4GEPLRRFo1wQEzfcuCcX/hS4eGSgVPu8p52meEzVW7Z9GLiKsmgSW+L5fW4k+kXGcOfKr1BarjfHa0pGcfoW/gb8BV2TFmX9rQk9ioh5m5NT97pv5KgrpPIU+HjUEe5ORebVZh5sW/R3Vh3PCyagINcIs=,iv:mU4P7BUnMjA/hIhX9SUImOuazoccPdnmeNIPGJUXaLw=,tag:EMXAVLgFZk3Mgv2O1rgibg==,type:str]
+    lastmodified: "2024-08-05T02:36:03Z"
+    mac: ENC[AES256_GCM,data:VD2tlgzwUujeuvO1SX4TBvJPyAQUKroZZ6KjJHwWvx/nOS/MfZQshuccP3QofHMKdBfSal22WVuxTzmzVCWv870/EOVKr3Tw1vAEpidDOLwmKHp6GrJXh5ReKg00j2yHgClsjetSMCQfaWmrO11Wa2UjS9+XDRMCQZ2sw2qbUtI=,iv:5kMwdTEeR7Dx0jfI4afeR88L1Sgij3S18KXGc77qzBU=,tag:4nKzV7vSX3T1b/HoAnCX8A==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.0
diff --git a/machines/massicot/services.nix b/machines/massicot/services.nix
index b16d42d..7989aeb 100644
--- a/machines/massicot/services.nix
+++ b/machines/massicot/services.nix
@@ -86,9 +86,9 @@ in
     provision = import ./kanidm-provision.nix;
   };
 
-  services.miniflux = {
+  custom.miniflux = {
     enable = true;
-    config = {
+    environment = {
       LISTEN_ADDR = "127.0.0.1:58173";
       OAUTH2_PROVIDER = "oidc";
       OAUTH2_CLIEND_ID = "miniflux";
@@ -97,7 +97,7 @@ in
       OAUTH2_USER_CREATION = 1;
       CREATE_ADMIN = lib.mkForce "";
     };
-    adminCredentialsFile = config.sops.secrets.miniflux_oauth_secret;
+    oauth2SecretFile = config.sops.secrets."miniflux/oauth2_secret".path;
   };
 
   services.matrix-conduit = {
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 0b31ac1..3fe5855 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -12,5 +12,6 @@
     ./ssh-tpm-agent.nix # FIXME: Waiting for upstream merge
     ./forgejo-actions-runner.nix
     ./oidc-agent.nix
+    ./miniflux.nix
   ];
 }
diff --git a/modules/nixos/miniflux.nix b/modules/nixos/miniflux.nix
new file mode 100644
index 0000000..9fcb8ad
--- /dev/null
+++ b/modules/nixos/miniflux.nix
@@ -0,0 +1,36 @@
+{ config, pkgs, lib, ... }:
+let
+  inherit (lib) mkEnableOption mkOption types;
+  cfg = config.custom.miniflux;
+in
+{
+  options = {
+    custom.miniflux = {
+      enable = mkEnableOption "miniflux";
+      oauth2SecretFile = mkOption {
+        type = types.path;
+      };
+      environmentFile = mkOption {
+        type = types.path;
+        default = "/dev/null";
+      };
+      environment = mkOption {
+        type = with types; attrsOf (oneOf [ int str ]);
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.miniflux = {
+      enable = true;
+      adminCredentialsFile = cfg.environmentFile;
+    };
+    systemd.services.miniflux = {
+      serviceConfig = {
+        LoadCredential = [ "oauth2_secret:${cfg.oauth2SecretFile}" ];
+        EnvironmentFile = [ "%d/oauth2_secret" ];
+      };
+      environment = lib.mapAttrs (_: lib.mkForce) (lib.mapAttrs (_: toString) cfg.environment);
+    };
+  };
+}