1 files changed, 64 insertions, 0 deletions

diff --git a/hosts/vidhar/firefly-iii/default.nix b/hosts/vidhar/firefly-iii/default.nix
new file mode 100644
index 00000000..026d4643
--- /dev/null
+++ b/hosts/vidhar/firefly-iii/default.nix
@@ -0,0 +1,64 @@
+{ config, ... }:
+{
+  config = {
+    services.postgresql = {
+      ensureDatabases = [ "firefly-iii" ];
+      ensureUsers = [
+        { name = "firefly-iii";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    services.firefly-iii = {
+      enable = true;
+      enableNginx = true;
+      group = "firefly-iii";
+      virtualHost = "firefly.yggdrasil.li";
+      settings = {
+        DB_CONNECTION = "pgsql";
+        DB_DATABASE = "firefly-iii";
+        APP_KEY_FILE = config.sops.secrets."firefly-iii_app_key".path;
+        APP_URL = "https://${config.services.firefly-iii.virtualHost}";
+      };
+    };
+
+    services.nginx = {
+      commonHttpConfig = ''
+        map $http_x_forwarded_proto $fastcgi_param_https_variable {
+            default ''';
+            https 'on';
+        }
+      '';
+      virtualHosts.${config.services.firefly-iii.virtualHost} = {
+        listen = [
+          { addr = "[2a03:4000:52:ada:4:1::]"; port = 9000; }
+        ];
+        extraConfig = ''
+          set_real_ip_from 2a03:4000:52:ada:4::;
+        '';
+        locations."~ \\.php$" = {
+          extraConfig = ''
+            fastcgi_param HTTPS $fastcgi_param_https_variable;
+          '';
+        };
+      };
+    };
+
+    sops.secrets."firefly-iii_app_key" = {
+      format = "binary";
+      sopsFile = ./app_key;
+      group = config.services.firefly-iii.group;
+      mode = "0440";
+      restartUnits = [ "firefly-iii-setup.service" "firefly-iii-cron.service" "phpfpm-firefly-iii.service" ];
+    };
+
+    users.groups.${config.services.firefly-iii.group} = {};
+
+    systemd.services = {
+      nginx.serviceConfig.SupplementaryGroups = [ config.services.firefly-iii.group ];
+      "firefly-iii-setup".serviceConfig.ReadWritePaths = [ "/run/postgresql" ];
+      "firefly-iii-cron".serviceConfig.ReadWritePaths = [ "/run/postgresql" ];
+    };
+  };
+}