bump version

modules/prometheus: support miniflux
modules/miniflux: use custom module to replace the upstream one
2024-08-05 20:07:03 +08:00 · 2024-08-05 20:04:37 +08:00 · 2024-08-05 20:04:10 +08:00
6 changed files with 158 additions and 40 deletions
--- a/flake.lock
+++ b/flake.lock
@ -2,11 +2,11 @@
  "nodes": {
    "catppuccin": {
      "locked": {
-        "lastModified": 1721784420,
-        "narHash": "sha256-bgF6fN4Qgk7NErFKGuuqWXcLORsiykTYyqMUFRiAUBY=",
+        "lastModified": 1722661201,
+        "narHash": "sha256-2JX3S1hmmUhHuyGyGWnaM4xT0SiaDdVkNzmBrEowwK0=",
        "owner": "catppuccin",
        "repo": "nix",
-        "rev": "8bdb55cc1c13f572b6e4307a3c0d64f1ae286a4f",
+        "rev": "19a0f144f0204a12a89243363efb6a493b8cfc83",
        "type": "github"
      },
      "original": {
@ -99,11 +99,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1722462338,
-        "narHash": "sha256-ss0G8t8RJVDewA3MyqgAlV951cWRK6EtVhVKEZ7J5LU=",
+        "lastModified": 1722630065,
+        "narHash": "sha256-QfM/9BMRkCmgWzrPDK+KbgJOUlSJnfX4OvsUupEUZvA=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "6e090576c4824b16e8759ebca3958c5b09659ee8",
+        "rev": "afc892db74d65042031a093adb6010c4c3378422",
        "type": "github"
      },
      "original": {
@ -119,11 +119,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1722136042,
-        "narHash": "sha256-x3FmT4QSyK28itMiR5zfYhUrG5nY+2dv+AIcKfmSp5A=",
+        "lastModified": 1722740924,
+        "narHash": "sha256-UQPgA5d8azLZuDHZMPmvDszhuKF1Ek89SrTRtqsQ4Ss=",
        "owner": "Mic92",
        "repo": "nix-index-database",
-        "rev": "c0ca47e8523b578464014961059999d8eddd4aae",
+        "rev": "97ca0a0fca0391de835f57e44f369a283e37890f",
        "type": "github"
      },
      "original": {
@ -143,11 +143,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1722476581,
-        "narHash": "sha256-dCNcvjaOTu+cPin3VUym9pglsghWYJe5oUpKTuAgiiU=",
+        "lastModified": 1722821408,
+        "narHash": "sha256-FMCo35ZmMfvAcae+9neKfu6QzXjU3WL6vW2OFMXx6wI=",
        "owner": "nix-community",
        "repo": "nix-vscode-extensions",
-        "rev": "1fe57eaf074d28246ec310486fe3db4ae44d0451",
+        "rev": "f25962fbd632afea744dc7e6868f24d2e73ccedb",
        "type": "github"
      },
      "original": {
@ -174,11 +174,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1722489601,
-        "narHash": "sha256-sB37J92AwEcmzg0GgxdI1TU6M+psUpbo0iYLFJBmsfo=",
+        "lastModified": 1722578639,
+        "narHash": "sha256-yge4OI8r8JBFtoajezauguXwYJ7M+Enwb3ZGbJF4YKA=",
        "owner": "xinyangli",
        "repo": "nixpkgs",
-        "rev": "eee3d54e62749dfd0f263e3903ca0ec1ebdbe72b",
+        "rev": "4c71f761584bd9f9a4c4ba090c353c7f3e65c430",
        "type": "github"
      },
      "original": {
@ -190,11 +190,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1722221733,
-        "narHash": "sha256-sga9SrrPb+pQJxG1ttJfMPheZvDOxApFfwXCFO0H9xw=",
+        "lastModified": 1722651103,
+        "narHash": "sha256-IRiJA0NVAoyaZeKZluwfb2DoTpBAj+FLI0KfybBeDU0=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "12bf09802d77264e441f48e25459c10c93eada2e",
+        "rev": "a633d89c6dc9a2a8aae11813a62d7c58b2c0cc51",
        "type": "github"
      },
      "original": {
@ -222,11 +222,11 @@
    },
    "nur": {
      "locked": {
-        "lastModified": 1722485061,
-        "narHash": "sha256-opkrX6noshjk2V3PKBiksA8+M6K7cu3EuiuAWL04pNs=",
+        "lastModified": 1722859145,
+        "narHash": "sha256-Y0X6yzkq5hU/A8MlC9/DfMz1i6mXEauD9539xUkEvo8=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "3bf06551d5922d420607091f5a3321e712ece307",
+        "rev": "ef567c82705d29b0b32d63ffd006c56c92953f4d",
        "type": "github"
      },
      "original": {
--- a/machines/massicot/secrets.yaml
+++ b/machines/massicot/secrets.yaml
@ -3,7 +3,7 @@ gts_env: ENC[AES256_GCM,data:CKFKHXCJvTD0HFkVrBWhabcl/cloCT03qcZIc5JymiIAu+o6wef
 hedgedoc_env: ENC[AES256_GCM,data:zwAA+zKSJT0tZyYArCaa1lfL0y8DNHDp/thS11DrVxNvjmk38o0ydsKArfZKzFYye+qNBzz1B4sPCdW4cFgQUNgbM+n9AvoMB8CssdmQ+sALKmozA5aEV23q+khZSGlHocP6WA==,iv:SgZruOS1nanK64Ex1dvgoD1HzbGbNa4DFSBuVoaNgEc=,tag:R+I8m1AloDCXs5PdpEpS0w==,type:str]
 grafana_oauth_secret: ENC[AES256_GCM,data:2dSgxeWXNtlvbrgW9whCVuM6tfzd4lVhynwQTSPbBJndhI8scpJle7LjI1+b14FS9boBsuYO+ym4Pf1I8/jJtKkj6X6I0BmXFBC/SfpCpo+ZGrxacg==,iv:N8iTPqMagKP3hWc7n0bjgYKvaFaw11ITvDn9lUkkAPY=,tag:Cz59fA2Zq3jVvhfxaFuGAA==,type:str]
 miniflux:
-    oauth2_secret: ENC[AES256_GCM,data:ktwQgPwcXTmMFhiTjXUGmPysfSg6X+EFBbfZMQ==,iv:vYF86NFW1EGf1TYLicTGiTIRKP/XC914zmVm42SyWPc=,tag:E1BdVp35362X373EE1HKvg==,type:str]
+    oauth2_secret: ENC[AES256_GCM,data:Q0JeT5VHGEDATXB9jf5+eU1Hoi9FsJrw6IK2T0bodvVgki+1oF+sWld5NGpoiXm/bQ==,iv:e8+84Zk5eXNIyIPhTG8jFhO+DCRorPFG0lDDNT4OxCs=,tag:IxlyFBcFaSy7Nz0aQCH3bw==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -28,8 +28,8 @@ sops:
            dnFBa0lDWWZtS1BHdzBoVzNTaGNkSEEKi/W1n7RT8NpTp00SBMwxsUJAPDhumJ/i
            V2VnaSNwouD3SswTcoBzqQpBP9XrqzjIYGke90ZODFQbMY9WDQ+O0g==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-05T07:07:04Z"
-    mac: ENC[AES256_GCM,data:1/PFLb8fgNgBz4YZDqNUxw5JMzt+ATD1wuFWNwJkVGVlXgLpSuOYZc5TYte3W8HTLDY8YOFYdcZtvDyjeFf7PAGxAVhqE1TgAfs0HxEHY3S8Ivcen86LTmcsiPy1frGHOLhzFfim3GRLyNA+MUFzCSLCbERJ0t0iK+L0EZ9SoyY=,iv:+DeQvoP3xBBEkv0IaQ5R0EFtQ/19bKSG/eRrDp4JPJs=,tag:Xz3sSbS07rcNaoImy10P5A==,type:str]
+    lastmodified: "2024-08-05T08:53:56Z"
+    mac: ENC[AES256_GCM,data:DtAL9k/t4pGV2UqCrb1R/1nT3gjJ8wced5yQOF5oneoncg/uuyX7IDZ0iZz0eGirj9Zadh9UQWNwxMzoiNu6pD1v04MkxT0NVDJ32vt5X+YDQJ60vRJjn9+zKvLk8Esx9sFsuBxjVXXmbtev7+djU+LbpPLfaobdheO2XlJXtdU=,iv:y2KI5ylgvuQ7ktYAr6XPEX3qyxnSP7BWC79mdsr4hgk=,tag:cvXvXeKvRwvttgQfmZRi2w==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.9.0
--- a/machines/massicot/services.nix
+++ b/machines/massicot/services.nix
@ -29,6 +29,7 @@ in
  custom.prometheus = {
    enable = true;
    exporters.blackbox.enable = true;
+    exporters.miniflux.enable = true;
  };

  systemd.mounts = map
@ -89,13 +90,14 @@ in
  custom.miniflux = {
    enable = true;
    environment = {
+      LOG_LEVEL = "debug";
      LISTEN_ADDR = "127.0.0.1:58173";
+      BASE_URL = "https://rss.xinyang.life/";
      OAUTH2_PROVIDER = "oidc";
-      OAUTH2_CLIEND_ID = "miniflux";
+      OAUTH2_CLIENT_ID = "miniflux";
      OAUTH2_REDIRECT_URL = "https://rss.xinyang.life/oauth2/oidc/callback";
      OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.xinyang.life/oauth2/openid/miniflux";
      OAUTH2_USER_CREATION = 1;
-      CREATE_ADMIN = lib.mkForce "";
    };
    oauth2SecretFile = config.sops.secrets."miniflux/oauth2_secret".path;
  };
@ -255,7 +257,7 @@ in
    '';

    virtualHosts."https://rss.xinyang.life".extraConfig = ''
-      reverse_proxy ${config.services.miniflux.config.LISTEN_ADDR}
+      reverse_proxy ${config.custom.miniflux.environment.LISTEN_ADDR}
    '';

    virtualHosts."https://ntfy.xinyang.life".extraConfig = ''
--- a/modules/nixos/miniflux.nix
+++ b/modules/nixos/miniflux.nix
@ -1,36 +1,133 @@
 { config, pkgs, lib, ... }:
 let
-  inherit (lib) mkEnableOption mkOption types;
+  inherit (lib) mkEnableOption mkPackageOption mkOption types literalExpression mkIf mkDefault;
  cfg = config.custom.miniflux;
+
+  defaultAddress = "localhost:8080";
+
+  pgbin = "${config.services.postgresql.package}/bin";
+  preStart = pkgs.writeScript "miniflux-pre-start" ''
+    #!${pkgs.runtimeShell}
+    ${pgbin}/psql "miniflux" -c "CREATE EXTENSION IF NOT EXISTS hstore"
+  '';
 in
 {
  options = {
    custom.miniflux = {
      enable = mkEnableOption "miniflux";
+
+      package = mkPackageOption pkgs "miniflux" { };
+
      oauth2SecretFile = mkOption {
        type = types.path;
      };
-      environmentFile = mkOption {
-        type = types.path;
-        default = "/dev/null";
-      };
+
      environment = mkOption {
        type = with types; attrsOf (oneOf [ int str ]);
      };
+
+      createDatabaseLocally = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether a PostgreSQL database should be automatically created and
+          configured on the local host. If set to `false`, you need provision a
+          database yourself and make sure to create the hstore extension in it.
+        '';
+      };
    };
  };

  config = lib.mkIf cfg.enable {
-    services.miniflux = {
+    services.miniflux.enable = false;
+    custom.miniflux.environment = {
+      LISTEN_ADDR = mkDefault defaultAddress;
+      RUN_MIGRATIONS = mkDefault 1;
+      DATABASE_URL = lib.mkIf cfg.createDatabaseLocally "user=miniflux host=/run/postgresql dbname=miniflux";
+      OAUTH2_CLIENT_SECRET_FILE = "%d/oauth2_secret";
+      WATCHDOG = mkDefault 1;
+    };
+
+    services.postgresql = lib.mkIf cfg.createDatabaseLocally {
      enable = true;
-      adminCredentialsFile = cfg.environmentFile;
+      ensureUsers = [{
+        name = "miniflux";
+        ensureDBOwnership = true;
+      }];
+      ensureDatabases = [ "miniflux" ];
    };
-    systemd.services.miniflux = {
+
+    systemd.services.miniflux-dbsetup = lib.mkIf cfg.createDatabaseLocally {
+      description = "Miniflux database setup";
+      requires = [ "postgresql.service" ];
+      after = [ "network.target" "postgresql.service" ];
      serviceConfig = {
+        Type = "oneshot";
+        User = config.services.postgresql.superUser;
+        ExecStart = preStart;
+      };
+    };
+
+    systemd.services.miniflux = {
+      description = "Miniflux service";
+      wantedBy = [ "multi-user.target" ];
+      requires = lib.optional cfg.createDatabaseLocally "miniflux-dbsetup.service";
+      after = [ "network.target" ]
+        ++ lib.optionals cfg.createDatabaseLocally [ "postgresql.service" "miniflux-dbsetup.service" ];
+
+      serviceConfig = {
+        Type = "notify";
+        ExecStart = lib.getExe cfg.package;
+        User = "miniflux";
+        DynamicUser = true;
        LoadCredential = [ "oauth2_secret:${cfg.oauth2SecretFile}" ];
-        EnvironmentFile = [ "%d/oauth2_secret" ];
+        RuntimeDirectory = "miniflux";
+        RuntimeDirectoryMode = "0750";
+        WatchdogSec = 60;
+        WatchdogSignal = "SIGKILL";
+        Restart = "always";
+        RestartSec = 5;
+
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
+        UMask = "0077";
      };
-      environment = lib.mapAttrs (_: lib.mkForce) (lib.mapAttrs (_: toString) cfg.environment);
+
+      environment = lib.mapAttrs (_: toString) cfg.environment;
    };
+    environment.systemPackages = [ cfg.package ];
+
+    security.apparmor.policies."bin.miniflux".profile = ''
+      include <tunables/global>
+      ${cfg.package}/bin/miniflux {
+        include <abstractions/base>
+        include <abstractions/nameservice>
+        include <abstractions/ssl_certs>
+        include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
+        r ${cfg.package}/bin/miniflux,
+        r @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size,
+        rw /run/miniflux/**,
+      }
+    '';
  };
 }
--- a/modules/nixos/prometheus/default.nix
+++ b/modules/nixos/prometheus/default.nix
@ -29,6 +29,7 @@ in
    ./caddy.nix
    ./gotosocial.nix
    ./immich.nix
+    ./miniflux.nix
    ./ntfy-sh.nix
    ./restic.nix
  ];
@ -48,7 +49,8 @@ in
        caddy.enable = mkExporterOption config.services.caddy.enable;
        gotosocial.enable = mkExporterOption config.services.gotosocial.enable;
        immich.enable = mkExporterOption config.services.immich.enable;
-        ntfy-sh.enable = mkExporterOption config.services.gotosocial.enable;
+        miniflux.enable = mkExporterOption config.services.miniflux.enable;
+        ntfy-sh.enable = mkExporterOption config.services.ntfy-sh.enable;
      };
      grafana = {
        enable = mkEnableOption "Grafana Cloud";
@ -94,11 +96,11 @@ in
            node = {
              enable = true;
              enabledCollectors = [
-                "diskstats"
                "loadavg"
                "time"
                "systemd"
              ];
+              listenAddress = "127.0.0.1";
              port = 9100;
            };
          };
--- a/modules/nixos/prometheus/miniflux.nix
+++ b/modules/nixos/prometheus/miniflux.nix
@ -0,0 +1,17 @@
+{ config, lib, ... }:
+let
+  cfg = config.custom.prometheus;
+in
+{
+  config = lib.mkIf (cfg.enable && cfg.exporters.miniflux.enable) {
+    systemd.services.miniflux.environment.METRICS_COLLECTOR = "1";
+    services.prometheus.scrapeConfigs = [
+      {
+        job_name = "miniflux";
+        static_configs = [
+          { targets = [ config.systemd.services.miniflux.environment.LISTEN_ADDR ]; }
+        ];
+      }
+    ];
+  };
+}
Author	SHA1	Message	Date
xinyangli	db2e696389	bump version	2024-08-05 20:07:03 +08:00
xinyangli	c4dadf2b45	modules/prometheus: support miniflux	2024-08-05 20:04:37 +08:00
xinyangli	1906c39add	modules/miniflux: use custom module to replace the upstream one	2024-08-05 20:04:10 +08:00