Aner Zakobar
61 lines
2.4 KiB
Nix
61 lines
2.4 KiB
Nix
{ config, lib, pkgs, homeyConfig, ... }:
|
|
|
|
# Eurovision Vote — Django app for ranking Eurovision performances.
|
|
#
|
|
# Uses the NixOS module from the eurovote flake (eurovote.nixosModules.default).
|
|
# This wrapper wires it into the homey module system: enable flag, sops secret,
|
|
# and uptime monitoring.
|
|
#
|
|
# The app uses DynamicUser + StateDirectory so systemd owns /var/lib/eurovote/;
|
|
# no tmpfiles.rules entry needed.
|
|
#
|
|
# Authentication: Caddy forward_auth → Authelia; the app reads the
|
|
# X-Remote-User header set by Caddy (from Authelia's Remote-User).
|
|
# All authenticated users get app access; /admin/* is restricted to
|
|
# group:admins by Authelia's access_control rules (see authelia.nix).
|
|
#
|
|
# Secrets consumed from sops:
|
|
# eurovote/secret_key
|
|
|
|
let
|
|
cfg = config.homey.eurovote;
|
|
domain = homeyConfig.domain;
|
|
in
|
|
{
|
|
options.homey.eurovote = {
|
|
enable = lib.mkEnableOption "Eurovision Vote app";
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
# -----------------------------------------------------------------------
|
|
# Secrets
|
|
# -----------------------------------------------------------------------
|
|
# mode 0444: the service runs as a DynamicUser (random UID) so it cannot
|
|
# read a root-owned 0400 file. /run/secrets/ itself is not world-listable
|
|
# (mode 0751), so world-readable here is acceptable on a home server.
|
|
sops.secrets."eurovote/secret_key" = { owner = "root"; mode = "0444"; };
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Service (options provided by eurovote.nixosModules.default)
|
|
# -----------------------------------------------------------------------
|
|
services.eurovote = {
|
|
enable = true;
|
|
port = 8007;
|
|
allowedHosts = "localhost 127.0.0.1 eurovision-vote.${domain}";
|
|
secretKeyFile = config.sops.secrets."eurovote/secret_key".path;
|
|
trustedOrigins = "https://eurovision-vote.${domain}";
|
|
# After SSO logout, send the user back to Authelia's logout page
|
|
logoutRedirectUrl = "https://auth.${domain}/logout";
|
|
};
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Uptime Kuma monitor
|
|
# -----------------------------------------------------------------------
|
|
homey.monitoring.monitors = [{
|
|
name = "Eurovision Vote";
|
|
url = "https://eurovision-vote.${domain}";
|
|
interval = 60;
|
|
}];
|
|
};
|
|
}
|