From a19097e11c83453dd0ef62eda5e1ec67ddd2963c Mon Sep 17 00:00:00 2001
From: Aner Zakobar <anerisreat@gmail.com>
Date: Mon, 6 Jul 2026 21:34:49 +0300
Subject: [PATCH] Added stirling pdf

---
 flake.nix                         |  1 +
 hosts/pi-main/default.nix         |  5 +-
 modules/services/stirling-pdf.nix | 94 +++++++++++++++++++++++++++++++
 3 files changed, 98 insertions(+), 2 deletions(-)
 create mode 100644 modules/services/stirling-pdf.nix

diff --git a/flake.nix b/flake.nix
index 0ca5440..ed66c16 100644
--- a/flake.nix
+++ b/flake.nix
@@ -80,6 +80,7 @@
           ./modules/services/paperless.nix
           ./modules/services/attic.nix
           ./modules/services/mealie.nix
+          ./modules/services/stirling-pdf.nix
           ./modules/services/uptime-kuma.nix
           ./modules/services/ntfy.nix
           ./modules/monitoring.nix
diff --git a/hosts/pi-main/default.nix b/hosts/pi-main/default.nix
index 85d0ff9..3d67dc8 100644
--- a/hosts/pi-main/default.nix
+++ b/hosts/pi-main/default.nix
@@ -89,8 +89,9 @@
   homey.transmission.enable = false;
 
   # Documents and recipes
-  homey.paperless.enable = true;
-  homey.mealie.enable    = true;
+  homey.paperless.enable    = true;
+  homey.mealie.enable       = true;
+  homey.stirlingPdf.enable  = true;
 
   # Reverse proxy + Cloudflare
   homey.caddy.enable      = true;
diff --git a/modules/services/stirling-pdf.nix b/modules/services/stirling-pdf.nix
new file mode 100644
index 0000000..f197fac
--- /dev/null
+++ b/modules/services/stirling-pdf.nix
@@ -0,0 +1,94 @@
+{ config, lib, pkgs, homeyConfig, ... }:
+
+let
+  cfg     = config.homey.stirlingPdf;
+  dataDir = config.homey.storage.mountPoint;
+  domain  = homeyConfig.domain;
+in
+{
+  options.homey.stirlingPdf = {
+    enable = lib.mkEnableOption "Stirling-PDF document tools";
+
+    image = lib.mkOption {
+      type    = lib.types.str;
+      default = "stirlingtools/stirling-pdf:latest";
+    };
+
+    port = lib.mkOption {
+      type    = lib.types.port;
+      default = 8084;
+      description = "Host port Stirling-PDF listens on (bound to 127.0.0.1).";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # -----------------------------------------------------------------------
+    # Container
+    # -----------------------------------------------------------------------
+    virtualisation.oci-containers.containers.stirling-pdf = {
+      image = cfg.image;
+      ports = [ "127.0.0.1:${toString cfg.port}:8080" ];
+
+      environment = {
+        # Disable Stirling-PDF's own login page — Authelia handles auth
+        DOCKER_ENABLE_SECURITY           = "false";
+        INSTALL_BOOK_AND_ADVANCED_HTML_OPS = "false";
+        LANGS                            = "en_GB";
+        TZ                               = homeyConfig.timezone;
+      };
+
+      volumes = [
+        "${dataDir}/stirling-pdf/configs:/configs"
+        "${dataDir}/stirling-pdf/customFiles:/customFiles"
+      ];
+
+      extraOptions = [ "--network=homey" ];
+    };
+
+    systemd.services."podman-stirling-pdf" = {
+      after    = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
+      requires = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
+    };
+
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — forward_auth to Authelia
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "pdf";
+      port      = cfg.port;
+      auth      = true;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Authelia access control — one_factor for any authenticated user
+    # -----------------------------------------------------------------------
+    homey.authelia.accessControlRules = [{
+      priority = 56;
+      domain   = [ "pdf.${domain}" ];
+      policy   = "one_factor";
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "stirling-pdf"; }
+      { path = "stirling-pdf/configs";     mode = "0755"; }
+      { path = "stirling-pdf/customFiles"; mode = "0755"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/stirling-pdf/configs" ];
+
+    # -----------------------------------------------------------------------
+    # Uptime Kuma monitor
+    # -----------------------------------------------------------------------
+    homey.monitoring.monitors = [{
+      name     = "Stirling-PDF";
+      url      = "https://pdf.${domain}";
+      interval = 60;
+    }];
+  };
+}