selfhostblocks/modules/services/pinchflat/docs/default.md

Pinchflat Service

Defined in /modules/services/pinchflat.nix.

This NixOS module is a service that sets up a Pinchflat instance.

Compared to the stock module from nixpkgs, this one sets up, in a fully declarative manner, LDAP and SSO integration and has a nicer option for secrets.

Usage

The following snippet assumes a few blocks have been setup already:

• the secrets block with SOPS,
• the shb.ssl block,
• the shb.lldap block.
• the shb.authelia block.

shb.pinchflat = {
  enable = true;

  secretKeyBase.result = config.shb.sops.secret."pinchflat/secretKeyBase".result;
  timeZone = "Europe/Brussels";
  mediaDir = "/srv/pinchflat";

  domain = "example.com";
  subdomain = "pinchflat";
  ssl = config.shb.certs.certs.letsencrypt.${domain};

  ldap = {
    enable = true;
    userGroup = "pinchflat_user";
  };
  sso = {
    enable = true;
    authEndpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";
  };
};
shb.sops.secret."pinchflat/secretKeyBase".request = config.shb.pinchflat.secretKeyBase.request;

Secrets can be randomly generated with nix run nixpkgs#openssl -- rand -hex 64.

Backup

Backing up Pinchflat using the Restic block is done like so:

shb.restic.instances."pinchflat" = {
  request = config.shb.pinchflat.backup;
  settings = {
    enable = true;
  };
};

The name "pinchflat" in the instances can be anything. The config.shb.pinchflat.backup option provides what directories to backup. You can define any number of Restic instances to backup Pinchflat multiple times.

Options Reference

id-prefix: services-pinchflat-options-
list-id: selfhostblocks-service-pinchflat-options
source: @OPTIONS_JSON@