Added stirling pdf

flake.nix

@@ -80,6 +80,7 @@
           ./modules/services/paperless.nix
           ./modules/services/attic.nix
           ./modules/services/mealie.nix
+          ./modules/services/stirling-pdf.nix
           ./modules/services/uptime-kuma.nix
           ./modules/services/ntfy.nix
           ./modules/monitoring.nix

hosts/pi-main/default.nix

@@ -91,6 +91,7 @@
   # Documents and recipes
   homey.paperless.enable    = true;
   homey.mealie.enable       = true;
+  homey.stirlingPdf.enable  = true;
 
   # Reverse proxy + Cloudflare
   homey.caddy.enable      = true;

modules/services/stirling-pdf.nix

@@ -0,0 +1,94 @@
+{ config, lib, pkgs, homeyConfig, ... }:
+
+let
+  cfg     = config.homey.stirlingPdf;
+  dataDir = config.homey.storage.mountPoint;
+  domain  = homeyConfig.domain;
+in
+{
+  options.homey.stirlingPdf = {
+    enable = lib.mkEnableOption "Stirling-PDF document tools";
+
+    image = lib.mkOption {
+      type    = lib.types.str;
+      default = "stirlingtools/stirling-pdf:latest";
+    };
+
+    port = lib.mkOption {
+      type    = lib.types.port;
+      default = 8084;
+      description = "Host port Stirling-PDF listens on (bound to 127.0.0.1).";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # -----------------------------------------------------------------------
+    # Container
+    # -----------------------------------------------------------------------
+    virtualisation.oci-containers.containers.stirling-pdf = {
+      image = cfg.image;
+      ports = [ "127.0.0.1:${toString cfg.port}:8080" ];
+
+      environment = {
+        # Disable Stirling-PDF's own login page — Authelia handles auth
+        DOCKER_ENABLE_SECURITY           = "false";
+        INSTALL_BOOK_AND_ADVANCED_HTML_OPS = "false";
+        LANGS                            = "en_GB";
+        TZ                               = homeyConfig.timezone;
+      };
+
+      volumes = [
+        "${dataDir}/stirling-pdf/configs:/configs"
+        "${dataDir}/stirling-pdf/customFiles:/customFiles"
+      ];
+
+      extraOptions = [ "--network=homey" ];
+    };
+
+    systemd.services."podman-stirling-pdf" = {
+      after    = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
+      requires = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
+    };
+
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — forward_auth to Authelia
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "pdf";
+      port      = cfg.port;
+      auth      = true;
+    }];
+
+    # -----------------------------------------------------------------------
+    # Authelia access control — one_factor for any authenticated user
+    # -----------------------------------------------------------------------
+    homey.authelia.accessControlRules = [{
+      priority = 56;
+      domain   = [ "pdf.${domain}" ];
+      policy   = "one_factor";
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "stirling-pdf"; }
+      { path = "stirling-pdf/configs";     mode = "0755"; }
+      { path = "stirling-pdf/customFiles"; mode = "0755"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths = [ "${dataDir}/stirling-pdf/configs" ];
+
+    # -----------------------------------------------------------------------
+    # Uptime Kuma monitor
+    # -----------------------------------------------------------------------
+    homey.monitoring.monitors = [{
+      name     = "Stirling-PDF";
+      url      = "https://pdf.${domain}";
+      interval = 60;
+    }];
+  };
+}