Pinchflat Service

Defined in /modules/services/pinchflat.nix.

This NixOS module is a service that sets up a Pinchflat instance.

Compared to the stock module from nixpkgs, this one sets up, in a fully declarative manner, LDAP and SSO integration and has a nicer option for secrets.

Features

Integration with the dashboard contract for displaying user facing application in a dashboard. Manual

Usage

Initial Configuration

The following snippet assumes a few blocks have been setup already:

shb.pinchflat = {
  enable = true;

  secretKeyBase.result = config.shb.sops.secret."pinchflat/secretKeyBase".result;
  timeZone = "Europe/Brussels";
  mediaDir = "/srv/pinchflat";

  domain = "example.com";
  subdomain = "pinchflat";
  ssl = config.shb.certs.certs.letsencrypt.${domain};

  ldap = {
    enable = true;
  };
  sso = {
    enable = true;
    authEndpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";
  };
};
shb.sops.secret."pinchflat/secretKeyBase".request = config.shb.pinchflat.secretKeyBase.request;

Secrets can be randomly generated with nix run nixpkgs#openssl -- rand -hex 64.

The user LDAP group is created automatically.

Backup

Backing up Pinchflat using the Restic block is done like so:

shb.restic.instances."pinchflat" = {
  request = config.shb.pinchflat.backup;
  settings = {
    enable = true;
  };
};

The name "pinchflat" in the instances can be anything. The config.shb.pinchflat.backup option provides what directories to backup. You can define any number of Restic instances to backup Pinchflat multiple times.

Application Dashboard

Integration with the dashboard contract is provided by the dashboard option.

For example using the Homepage service:

{
  shb.homepage.servicesGroups.Media.services.Pinchflat = {
    sortOrder = 2;
    dashboard.request = config.shb.pinchflat.dashboard.request;
  };
}

Options Reference

id-prefix: services-pinchflat-options-
list-id: selfhostblocks-service-pinchflat-options
source: @OPTIONS_JSON@

2.9 KiB Raw Permalink Blame History