Runner updated and eurovote

2026-05-20 11:12:32 +03:00
parent d2793904f4
commit 42d91012c1
12 changed files with 170 additions and 21 deletions
@@ -0,0 +1,60 @@
+{ config, lib, pkgs, homeyConfig, ... }:
+
+# Eurovision Vote — Django app for ranking Eurovision performances.
+#
+# Uses the NixOS module from the eurovote flake (eurovote.nixosModules.default).
+# This wrapper wires it into the homey module system: enable flag, sops secret,
+# and uptime monitoring.
+#
+# The app uses DynamicUser + StateDirectory so systemd owns /var/lib/eurovote/;
+# no tmpfiles.rules entry needed.
+#
+# Authentication: Caddy forward_auth → Authelia; the app reads the
+# X-Remote-User header set by Caddy (from Authelia's Remote-User).
+# All authenticated users get app access; /admin/* is restricted to
+# group:admins by Authelia's access_control rules (see authelia.nix).
+#
+# Secrets consumed from sops:
+#   eurovote/secret_key
+
+let
+  cfg    = config.homey.eurovote;
+  domain = homeyConfig.domain;
+in
+{
+  options.homey.eurovote = {
+    enable = lib.mkEnableOption "Eurovision Vote app";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # -----------------------------------------------------------------------
+    # Secrets
+    # -----------------------------------------------------------------------
+    # mode 0444: the service runs as a DynamicUser (random UID) so it cannot
+    # read a root-owned 0400 file. /run/secrets/ itself is not world-listable
+    # (mode 0751), so world-readable here is acceptable on a home server.
+    sops.secrets."eurovote/secret_key" = { owner = "root"; mode = "0444"; };
+
+    # -----------------------------------------------------------------------
+    # Service (options provided by eurovote.nixosModules.default)
+    # -----------------------------------------------------------------------
+    services.eurovote = {
+      enable        = true;
+      port          = 8007;
+      allowedHosts  = "localhost 127.0.0.1 eurovision-vote.${domain}";
+      secretKeyFile  = config.sops.secrets."eurovote/secret_key".path;
+      trustedOrigins = "https://eurovision-vote.${domain}";
+      # After SSO logout, send the user back to Authelia's logout page
+      logoutRedirectUrl = "https://auth.${domain}/logout";
+    };
+
+    # -----------------------------------------------------------------------
+    # Uptime Kuma monitor
+    # -----------------------------------------------------------------------
+    homey.monitoring.monitors = [{
+      name     = "Eurovision Vote";
+      url      = "https://eurovision-vote.${domain}";
+      interval = 60;
+    }];
+  };
+}