Karakeep

Defined in /modules/blocks/karakeep.nix, found in the selfhostblocks.nixosModules.karakeep module. See the manual for how to import the module in your code.

This service sets up Karakeep which is a bookmarking service powered by LLMs. It integrates well with Ollama.

Features

Declarative LDAP Configuration.
- Needed LDAP groups are created automatically.
Declarative SSO Configuration.
- When SSO is enabled, login with user and password is disabled.
- Registration is enabled through SSO.
Meilisearch configured with production environment and master key.
Access through subdomain using reverse proxy.
Access through HTTPS using reverse proxy.
Backup through the backup block.
Integration with the dashboard contract for displaying user facing application in a dashboard. Manual

Usage

Initial Configuration

The following snippet assumes a few blocks have been setup already:

{
  shb.karakeep = {
    enable = true;
    domain = "example.com";
    subdomain = "karakeep";

    ssl = config.shb.certs.certs.letsencrypt.${domain};

    nextauthSecret.result = config.shb.sops.secret.nextauthSecret.result;

    sso = {
      enable = true;
      authEndpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";

      sharedSecret.result = config.shb.sops.secret.oidcSecret.result;
      sharedSecretForAuthelia.result = config.shb.sops.secret.oidcAutheliaSecret.result;
    };
  };

  shb.sops.secret.nextauthSecret.request = config.shb.karakeep.nextauthSecret.request;
  shb.sops.secret."karakeep/oidcSecret".request = config.shb.karakeep.sso.sharedSecret.request;
  shb.sops.secret."karakeep/oidcAutheliaSecret" = {
    request = config.shb.karakeep.sso.sharedSecretForAuthelia.request;
    settings.key = "karakeep/oidcSecret";
  };
}

Secrets can be randomly generated with nix run nixpkgs#openssl -- rand -hex 64.

The user and admin LDAP groups are created automatically.

Application Dashboard

Integration with the dashboard contract is provided by the dashboard option.

For example using the Homepage service:

{
  shb.homepage.servicesGroups.Documents.services.Karakeep = {
    sortOrder = 3;
    dashboard.request = config.shb.karakeep.dashboard.request;
  };
}

An API key can be set to show extra info:

{
  shb.homepage.servicesGroups.Documents.services.Karakeep = {
    apiKey.result = config.shb.sops.secret."karakeep/homepageApiKey".result;
  };

  shb.sops.secret."karakeep/homepageApiKey".request =
    config.shb.homepage.servicesGroups.Documents.services.Karakeep.apiKey.request;
}

Integration with Ollama

Assuming ollama is enabled, it will be available on port config.services.ollama.port. The following snippet sets up acceleration using an AMD (i)GPU and loads some models.

{
  services.ollama = {
    enable = true;

    # https://wiki.nixos.org/wiki/Ollama#AMD_GPU_with_open_source_driver
    acceleration = "rocm";

    # https://ollama.com/library
    loadModels = [
      "deepseek-r1:1.5b"
      "llama3.2:3b"
      "llava:7b"
      "mxbai-embed-large:335m"
      "nomic-embed-text:v1.5"
    ];
  };
}

Integrating with the ollama service is done with:

{
  services.open-webui = {
    environment.OLLAMA_BASE_URL = "http://127.0.0.1:${toString config.services.ollama.port}";
  };
}

Notice we're using the upstream service here services.open-webui, not shb.open-webui.

Options Reference

id-prefix: services-karakeep-options-
list-id: selfhostblocks-services-karakeep-options
source: @OPTIONS_JSON@

4.7 KiB Raw Blame History