5 files changed, 95 insertions, 1 deletions

diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix
index 9660931d..90e58b42 100644
--- a/hosts/vidhar/default.nix
+++ b/hosts/vidhar/default.nix
@@ -4,7 +4,7 @@ with lib;
 
 {
   imports = with flake.nixosModules.systemProfiles; [
-    ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix ./paperless
+    ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix ./paperless ./firefly-iii
     tmpfs-root zfs
     initrd-all-crypto-modules default-locale openssh rebuild-machines
     build-server
diff --git a/hosts/vidhar/firefly-iii/app_key b/hosts/vidhar/firefly-iii/app_key
new file mode 100644
index 00000000..b318b9c1
--- /dev/null
+++ b/hosts/vidhar/firefly-iii/app_key
@@ -0,0 +1,24 @@
+{
+        "data": "ENC[AES256_GCM,data:Z/u19vdnY5B76AaQCZOaXGRHTXiAaZ3OlnpEwehK40De6EoTzvs8BzC4/a6KVam5JDjcog==,iv:ZlCNcjQV1brRllTVdfFjhOcDe7sjHIRVbjs/dNT/w0o=,tag:bAtBraAy+i02pyVuhWoXBg==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIZEZVVTZLU2VPQmM2Tjk3\nVEUvVitWRjdGRnE2Vm9FVjFhTk1IZ0g1bjJjCjd5dnZNd1VrTVc4QktRM0Z2aFdp\nVlRqLy9BMDV4VGI1SjdmWTFFVFZONG8KLS0tIHRYMGlpalZZUEJFU3c0Z0hXK1lQ\ndnFndWJmTTFjWVAzdkhwN0x6eHVHVmsKVls/ERf4ZfnTqryB6yt5OcjU42RlgAoD\nmMZzuEbhuGBApu2rEKlo4v/AKST6OVIlsiYr0na2W4vlmBOEs8OB1g==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCcVVJZWNkMzlYc1lOMzlu\nai82RjhkZm5UYVplV0NNTjZlWm8zcmpCaW1BCnhMaGV5NFNkUUw5ODM5OVZZMUxO\nUUpVTGhtZDM4VzF3WXhTMFpHLytKUzAKLS0tIEZCSVFIODRhRDZuMzFFbSt1YlBI\ndldaZEd6dTBvU2huREhoQ3VNQ2NNdWMKyGuG1tzxIas5G6nlWRkgbxHTOGQ8cLx6\nOw83t98BBfWSZVTuUfHAemn5fPsjRUhsZvEuH70NvQXDRxSvV2nvww==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-02-18T18:05:57Z",
+                "mac": "ENC[AES256_GCM,data:7rl6npBWEFeS+IZMLb2+jLcs1d5gSzZyGkCDcrpAbxAB7doAp4vh5DJUEFnAUMtN/iHlwjX71pRNjBHLlYqCs344aaGkcEVMDO/C2m8efuPq+qIi+z372PlM+ekVDXquthvc8fcPhsCWHyso1LTpDjMRqf6kizk0wEtwJj5kOWA=,iv:OEaeQUJ2f0XZidWkttC8Y+WAkDyNkViTNiiDgy5QKr8=,tag:ERsBlT0T3iZvoEWcRhTpPA==,type:str]",
+                "pgp": null,
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.9.4"
+        }
+}
\ No newline at end of file
diff --git a/hosts/vidhar/firefly-iii/default.nix b/hosts/vidhar/firefly-iii/default.nix
new file mode 100644
index 00000000..026d4643
--- /dev/null
+++ b/hosts/vidhar/firefly-iii/default.nix
@@ -0,0 +1,64 @@
+{ config, ... }:
+{
+  config = {
+    services.postgresql = {
+      ensureDatabases = [ "firefly-iii" ];
+      ensureUsers = [
+        { name = "firefly-iii";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    services.firefly-iii = {
+      enable = true;
+      enableNginx = true;
+      group = "firefly-iii";
+      virtualHost = "firefly.yggdrasil.li";
+      settings = {
+        DB_CONNECTION = "pgsql";
+        DB_DATABASE = "firefly-iii";
+        APP_KEY_FILE = config.sops.secrets."firefly-iii_app_key".path;
+        APP_URL = "https://${config.services.firefly-iii.virtualHost}";
+      };
+    };
+
+    services.nginx = {
+      commonHttpConfig = ''
+        map $http_x_forwarded_proto $fastcgi_param_https_variable {
+            default ''';
+            https 'on';
+        }
+      '';
+      virtualHosts.${config.services.firefly-iii.virtualHost} = {
+        listen = [
+          { addr = "[2a03:4000:52:ada:4:1::]"; port = 9000; }
+        ];
+        extraConfig = ''
+          set_real_ip_from 2a03:4000:52:ada:4::;
+        '';
+        locations."~ \\.php$" = {
+          extraConfig = ''
+            fastcgi_param HTTPS $fastcgi_param_https_variable;
+          '';
+        };
+      };
+    };
+
+    sops.secrets."firefly-iii_app_key" = {
+      format = "binary";
+      sopsFile = ./app_key;
+      group = config.services.firefly-iii.group;
+      mode = "0440";
+      restartUnits = [ "firefly-iii-setup.service" "firefly-iii-cron.service" "phpfpm-firefly-iii.service" ];
+    };
+
+    users.groups.${config.services.firefly-iii.group} = {};
+
+    systemd.services = {
+      nginx.serviceConfig.SupplementaryGroups = [ config.services.firefly-iii.group ];
+      "firefly-iii-setup".serviceConfig.ReadWritePaths = [ "/run/postgresql" ];
+      "firefly-iii-cron".serviceConfig.ReadWritePaths = [ "/run/postgresql" ];
+    };
+  };
+}
diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index 3ead8fac..5398cbee 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -93,6 +93,7 @@ table inet filter {
   counter pgbackrest-rx {}
   counter immich-rx {}
   counter paperless-rx {}
+  counter firefly-rx {}
 
   counter established-rx {}
 
@@ -123,6 +124,7 @@ table inet filter {
   counter pgbackrest-tx {}
   counter immich-tx {}
   counter paperless-tx {}
+  counter firefly-tx {}
 
   counter tx {}
 
@@ -200,6 +202,7 @@ table inet filter {
 
     iifname bifrost tcp dport 2283 ip6 saddr $bifrost_surtr counter name immich-rx accept
     iifname bifrost tcp dport 28981 ip6 saddr $bifrost_surtr counter name paperless-rx accept
+    iifname bifrost tcp dport 9000 ip6 saddr $bifrost_surtr counter name firefly-rx accept
 
     ct state { established, related } counter name established-rx accept
 
@@ -250,6 +253,7 @@ table inet filter {
 
     iifname bifrost tcp sport 2283 ip6 daddr $bifrost_surtr counter name immich-tx accept
     iifname bifrost tcp sport 28981 ip6 daddr $bifrost_surtr counter name paperless-tx accept
+    iifname bifrost tcp sport 28981 ip6 daddr $bifrost_surtr counter name firefly-tx accept
 
 
     counter name tx
diff --git a/hosts/vidhar/pgbackrest/default.nix b/hosts/vidhar/pgbackrest/default.nix
index 1e0828ce..38d68335 100644
--- a/hosts/vidhar/pgbackrest/default.nix
+++ b/hosts/vidhar/pgbackrest/default.nix
@@ -159,5 +159,7 @@ in {
       group = "pgbackrest";
       mode = "0400";
     };
+
+    systemd.services.postgresql.serviceConfig.SupplementaryGroups = [ "pgbackrest" ];
   };
 }