Merge pull request 'RSS reader' (#217) from feat/tt-rss into main

Reviewed-on: #217
Reviewed-by: teutat3s <teutat3s@noreply.git.pub.solar>

hosts/default.nix

@@ -33,6 +33,7 @@
           self.nixosModules.promtail
           self.nixosModules.searx
           self.nixosModules.tmate
+          self.nixosModules.tt-rss
           self.nixosModules.obs-portal
           self.nixosModules.matrix
           self.nixosModules.matrix-irc

modules/nginx/default.nix

@@ -10,9 +10,10 @@ let
   webserverGroup = "hakkonaut";
 in
 {
+  users.users.nginx.extraGroups = [ webserverGroup ];
+
   services.nginx = {
     enable = true;
-    group = webserverGroup;
     enableReload = true;
     proxyCachePath.cache = {
       enable = true;

modules/tt-rss/default.nix

@@ -0,0 +1,81 @@
+{
+  flake,
+  config,
+  pkgs,
+  ...
+}:
+let
+  ttrss-auth-oidc = pkgs.stdenv.mkDerivation {
+    name = "ttrss-auth-oidc";
+    version = "7ebfbc91e92bb133beb907c6bde79279ee5156df";
+    src = pkgs.fetchgit {
+      url = "https://git.tt-rss.org/fox/ttrss-auth-oidc.git";
+      hash = "sha256-G6vZBvSWms6s6nHZWsxJjMGuubt/imiBvbp6ykwrZbg=";
+    };
+    installPhase = ''
+      mkdir -p $out/auth_oidc
+      cp -r * $out/auth_oidc
+    '';
+  };
+in
+{
+  age.secrets.tt-rss-database-password = {
+    file = "${flake.self}/secrets/tt-rss-database-password.age";
+    owner = "tt_rss";
+    mode = "600";
+  };
+  age.secrets.tt-rss-keycloak-client-secret = {
+    file = "${flake.self}/secrets/tt-rss-keycloak-client-secret.age";
+    owner = "tt_rss";
+    mode = "600";
+  };
+  age.secrets.tt-rss-smtp-password = {
+    file = "${flake.self}/secrets/tt-rss-smtp-password.age";
+    owner = "tt_rss";
+    mode = "600";
+  };
+  age.secrets.tt-rss-feed-crypt-key = {
+    file = "${flake.self}/secrets/tt-rss-feed-crypt-key.age";
+    owner = "tt_rss";
+    mode = "600";
+  };
+
+  services.nginx.virtualHosts."rss.${config.pub-solar-os.networking.domain}" = {
+    enableACME = true;
+    forceSSL = true;
+  };
+
+  services.tt-rss = {
+    enable = true;
+    virtualHost = "rss.${config.pub-solar-os.networking.domain}";
+    selfUrlPath = "https://rss.${config.pub-solar-os.networking.domain}";
+    root = "/var/lib/tt-rss";
+    logDestination = "";
+    plugins = [
+      "auth_internal"
+      "note"
+      "auth_oidc"
+    ];
+    pluginPackages = [ ttrss-auth-oidc ];
+    email = {
+      server = "mail.pub.solar";
+      security = "tls";
+      login = "admins@pub.solar";
+      fromName = "pub.solar RSS server";
+      fromAddress = "rss@pub.solar";
+      digestSubject = "[RSS] New headlines for last 24 hours";
+    };
+    database = {
+      passwordFile = config.age.secrets.tt-rss-database-password.path;
+      createLocally = true;
+    };
+    extraConfig = ''
+      putenv('TTRSS_SMTP_PASSWORD=' . file_get_contents('${config.age.secrets.tt-rss-smtp-password.path}'));
+      putenv('TTRSS_AUTH_OIDC_NAME=pub.solar ID');
+      putenv('TTRSS_AUTH_OIDC_URL=https://auth.${config.pub-solar-os.networking.domain}/realms/${config.pub-solar-os.auth.realm}/');
+      putenv('TTRSS_AUTH_OIDC_CLIENT_ID=tt-rss');
+      putenv('TTRSS_AUTH_OIDC_CLIENT_SECRET=' . file_get_contents('${config.age.secrets.tt-rss-keycloak-client-secret.path}'));
+      putenv('TTRSS_FEED_CRYPT_KEY=' . file_get_contents('${config.age.secrets.tt-rss-feed-crypt-key.path}'));
+    '';
+  };
+}

secrets/secrets.nix

@@ -74,6 +74,11 @@ in
   "obs-portal-env.age".publicKeys = nachtigallKeys ++ adminKeys;
   "obs-portal-database-env.age".publicKeys = nachtigallKeys ++ adminKeys;
 
+  "tt-rss-feed-crypt-key.age".publicKeys = nachtigallKeys ++ adminKeys;
+  "tt-rss-keycloak-client-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
+  "tt-rss-smtp-password.age".publicKeys = nachtigallKeys ++ adminKeys;
+  "tt-rss-database-password.age".publicKeys = nachtigallKeys ++ adminKeys;
+
   # mail
   "mail/hensoko.age".publicKeys = metronomKeys ++ adminKeys;
   "mail/teutat3s.age".publicKeys = metronomKeys ++ adminKeys;

secrets/tt-rss-database-password.age

@@ -0,0 +1,43 @@
+age-encryption.org/v1
+-> ssh-ed25519 iDKjwg Rmuo9gHlxKcV1ZEpZzKNH/uBI1NLUkg6vUmHVfPMkww
+jr2ghWA4WTukxsqxsVtLtWh/pSBjh1npGxMmXb8KGAQ
+-> ssh-ed25519 uYcDNw pKvS1EYMGay85A5FzdzurBtyrJd6wauN9fnrVqdsCls
+UkQGsl82SgbWvBuQ+rKkDuF92XFH8kYDUPsQlCLbZmc
+-> ssh-rsa f5THog
+SfjDPGPRBgcLhXsx8BXkH7dJjlGmBD8DBEUl2ov8Pdld3tdWFJS2ynerFWUs/DiO
+bj0PtwEZVz7Tbdu8RujaQU6MsGW2D8yXSn26m8sN8rVmfG2UnFGrz08403+YO2HA
+XOhBM8Y/ASFNvOvVFGLa0Q4rjHCyY880TrtHUk6YxRgx7wASW+kTbCs7cF1Fzv4j
+oIslUO4WztuEI9PkX9/foxebnG2dOH72YfA6JD35dfP5oWHmNZBWAQYhaafNVy90
+1jso1pzNsZfy2fx/1DHbSmsj6mZ5Mi/Tl6pt0SlhoLP3FXgRqqygvnvIGmwlrGuA
+P/6gIC4544BR3YSuSbGba+X7nBkH67H6vniKt41BYDrGifNhEIdbW4FcNAFaKxIA
+xpCtW8+anIhZvtx2806wYEl7TRLAjWxLutymJunNxrcWd3kbbNBuXuQ+/JH10fIC
+3Pbqa6VoZNtrXY9Wg24SwSY5hEjX4BhxHwDEKhEhDEYirxDO3iXheh0o3151VuFD
+yOsdO40LFzAvdS152HyTDDlm/cd4gksE8Z/Ldi+reZV8YGfhKIhsGm3KMbmKHDAS
+sCpR282b2r4mJx78NMWXxrIB9/cJ2o5Lw7HFZosltksBLt/KF6LIMYerW8bSUfsQ
+gdh2ms7tB2TmQZxjDC73B0NGSLCLUm6Jel7QWoJ+InU
+-> ssh-rsa kFDS0A
+DSQpUzRZ2VXx6H++q114X1DBb/HStyFEYSxMEWOLlnA0tNCvQagDcbsJ1cHHV8BH
+ATVAim64+FrQ+vQvs3+cNTu20gwTLyc0YhwtK6fRQ8WZ94Z4CqjUsipi1Q8qvehH
+KVMRJmK1yYB9NqwckH2BNYpP92iaEw5IggGnmx+V2RMsUje8zUqYqdLBeyWKALJt
+mt4BKlCxoLEjqoQ/YKc2uxZfUA3bC6AxYEySJ5isjnPDcWu/Tm55YqoUtY7CePmY
+IiGhQvlEKC7pLHEiwbIdFyka/CZZLufWN7eGXJ7+RMH6OUjUPeh/2SEKIaAKzzKr
+nERja7Z9VE0rvgf0HRdDop0lq+liy0PHYodMtRor7vTPEnnAfOvtL2zQekOySSsg
+wEgbHSbF6904tvAGquaG4Cxl+EOYPzQdXn2ezKHoq6LoD12s5fNyaL9wRD29v2gm
+eY8B/ntf4ylJqyVfUIw5b+ZT/knGiTRdBV673XbBv9oblYBrMhTp3o7XHq1X0xTO
+YucaI5goANdWoerko28ncWwE3bqBO7MZ8hQwtAPJfw2Hh+JM5nuN0HJYhX043vir
+qsVbRi4ue66cXYkalKWrprevu4glj/WTHo2vhdyiP8zg39e8J0GNVJCLihFV7713
+YjTvFz9qMeXrjAtr9YmufoHAHxjMcw/1t5OeD4b35hQ
+-> piv-p256 vRzPNw AiStjTWp7vqdmKCmodhBH3u2BWPNaVVRyqa8OctVdIbd
+65K8SMkU2/rKRInZHUf2ixgiD365smU3mIEYquFcB/E
+-> piv-p256 zqq/iw Aw1hdO7kDXZ3DidOBhr0S6Up0pCOMsDaBMTi1KBZQk+B
+DfPv+atM/MqoNd74V5+bbblWPzVK1qY+i1wjVM2ogYw
+-> ssh-ed25519 YFSOsg JjyRwG5LuMzSecUzVO+5tY08+ZTWauFoEirsklQtC2U
+TY8dH/SojEI7j4ZRhmueZGkkTztJZP1hqQoh9rsIBB0
+-> ssh-ed25519 iHV63A pTeRsEGqsN9MdMG6EtNFc4X8hCoQduZuOaWQeR8Nkls
+hEFZz6E7ScMAmRV/6/eCAnjLrcq4YKACFb6SHpf/BgA
+-> ssh-ed25519 BVsyTA 8IvmdylPPUpTusopX1MvkARh3pH1BSVxPA5FgtKs7lg
+O4t5IsT+QJZCi5p54RFDL7eMQwBHM6iyN8Lyezqa2KI
+-> ssh-ed25519 +3V2lQ 1TO9971nCZcjgX25TTyliQI0EOkkgij/UiMPxdRrbSc
+bBcOBaXjfIufsVYYWeuPsW10pv9RONEo6IHn7a9lLSM
+--- 2+W69jUROFmdyrKCnrfbMLTZak06ALOewOoBGDmgR3E
+ÍÔÔ\Œ›þài²öD[F7‡x E}[;P:´¸=`åÄÜ<C384>¢ž®Ü Ê<>½éýžèõ`×XH5Y@Ì+Tá}<7D><>^˜Í'<27><>÷Šˆ„LÙ2I

secrets/tt-rss-feed-crypt-key.age

@@ -0,0 +1,43 @@
+age-encryption.org/v1
+-> ssh-ed25519 iDKjwg vfEasZhvmRBhOIDsPAM4jFu4aoFvWLU4J9KUczL+PDk
+M23/7nSk67BhGWcg+0dl64VukBmfUsm7u452V7wGFmM
+-> ssh-ed25519 uYcDNw v/Y33K17DWlWUZtnqfWFnUhALeqi2k/FuWIXk4roX2c
+2NwDaCu9+jiwDv+WxMlm+7hj1YuePHusoSTF4AXkhU8
+-> ssh-rsa f5THog
+FzlrvRdqejC1HQqtIjWBqpheJvVPNo17qss2yMUD3VoSqErZQHNPpLaLRtdChphJ
+Zmx3zibSMhqxYsG01KTFvQe3Nx+g0agldHuW//h9c6vYx9oGir0zASK72yS4jkiJ
+PQFWPzMsNyZZGD4702FOIhKSUWJunPn6hiMsWvOhwyiZcoIuJOtXcQp2HnOZNbnD
+PxDZAYf/oCGUJnqBbR8koMTvJmlg8xwaZOpXfZvbHSNHjTv5XJxwz78C2ITomkyg
+9nOCdayp9tkT08wPw/0LylFPgMBmzj3FnBgNkRe6gMhQDwgBlI50WrsU39bnQDTL
+fQWtp2+SLotlSQh87WyzjrDFSmPduRXwjljIDO71ltD3Vn8Ug9v/H+NDXJRVjfHm
+UWjioNFhIZbxHPijrA7dsJU4UHe27da5o7eph79lWG02jbHq//y8jBr5lipxnT0a
+4+83a3Pe9SCgmACO7v22RX+X0+5tkBU+uJDuOu9Zj762rw1Lzf936sZJPDZwV0Su
+BDWXJmxeYC3cu6SGZo8gNTgR6sRHtjTTYl9w/DE9fg1mXg/Evd8wy5rhNEYZGvK6
+cnSwK+j6TyZZfu8PoY7HAT0qImINy/FLYj2ZlsVhqBc5IJsAwQdPOLpyEurNTLQ2
+OGXgJKROCe7VPLRh2lzmGjofJsNvE8RpcbGdMvkrVIc
+-> ssh-rsa kFDS0A
+bHnWewzISj/Lxt/L1UhpivLUpt2Ycjqty4upRYp/qk9IIAdL6FJX97xes4DJXhyV
+NHUZbldtZBAZqRZJsnK6pwAWvmrWBr9FiMMJMDNmdKOyEhLGCPf59DNx+GJZXVXv
+pKDUFpzNgl1BQcLk9TgDYJXbWa87jdU+vynbcCqeljKi3U9j22i1qW1x7yQWhwJa
+jzoXsg5A42AjUuElE5pzUyELg4jSbZ+VVPhO48OI2rWGZzzKrtwNxVyX0b2DVlRQ
+14VzAnsGjb1R34N2VK15gn2KlUH2OIieLXSd3CcxJKlb2a4Z7OoIIBs06Dzw8xm0
+/wFYWF/QrweUC2IXGRMnZeqN0vsmP3Gr4k3bw5SLtGanM9Oj66xyaH94D6qUtBnR
+hXXk1BQTAvhFC9+cYNICNvG264htmZG+NhzLi7ZF/Fc+JCbZk5fEi5yUA3WIftsZ
+IQaw8p0IkOXHTPkqY51irPs0NgYBxNxeacCK/Alp9ox9AS/+sWof8WVqTEGBynKA
+IWfI4J85DD56R4Frty38MzJF1YRdJXoV9yiJOjudcqxxOhEKDmg9GwEXHBEBEN5q
+aTp/j3rhF/kGi8B1c0QOMCpwMJjSVuVHQotho0uurfK1o6uNOqC8ujPIrMvEqNgG
+lJZhSUH6k0lhxy7v5ZpgDNYhNmaF4pumcw14zxkBs7E
+-> piv-p256 vRzPNw Ah3rXIanivD7dPTtm9r76B1sotfjMgvtHm+97vssIG2P
+JyjlBhCLCTcInAXBYSMxZIaV9aP4gVKLe6hZdaE6eAY
+-> piv-p256 zqq/iw A9UAqv8om0NNRGwD8M3VJZ1L1j8X+cfWbR2PkWt94BqK
+qcujrlJGmMOQzep8nMSIpofz8VRaPfR6YMq+C7fcU5Y
+-> ssh-ed25519 YFSOsg /whYZOvh+Aba9f3m+x+hdmYaA9j8mCFotDVHDMS8ITs
+ErtRlCp1beiDWy4UXXOOewSoalizzl9KctffG2AfVUw
+-> ssh-ed25519 iHV63A nWzVrXkv7vXgi51c1y7EhBSFeNWFCvn9tcgQjgzFJSY
+88t2juhjffDgIfKelvk4QFowE0QASmE8JOCKybLH238
+-> ssh-ed25519 BVsyTA PKDhexn3ywxXhT/jngwiT7IB+53Z3EXhm48p1M8BMSY
+kttvqJdmrsqbOSYjjPvDw6P4EGxZCL2heumtY3Zv+Jc
+-> ssh-ed25519 +3V2lQ ZPMURJOgfcJsL5vQxsoooQOYf8QxLV8n1v7GXiwmIwQ
+hPzWtQc43Yt+r2c18g9Hk/LHG+Fp2b2JHvEikPoqk3s
+--- 43rso6SPXyFsJTIH+ZDav6gtcLPtScE1aFm1Isn/T+s
+bｾx笳4ﾖu櫪ﾕｬwZｶｸﾊu=V;Mﾖ､ﾇｴﾚ<EFBDB4>
鏆,U
Oﾌ逡HﾗﾌｯPH<50>t

secrets/tt-rss-keycloak-client-secret.age

@@ -0,0 +1,43 @@
+age-encryption.org/v1
+-> ssh-ed25519 iDKjwg 4nKs3hgPdflQ1qQklPJuNNOAicxBKkleH8l+D5KQaxk
+QvHc3IY8BT6ypaiGIaHIXl/a9ZDPlbFfIMVfwcb7mV0
+-> ssh-ed25519 uYcDNw Z1junJXISjPE46E4inxFQqqfY4E3kBkCxUJcvseaYy4
+9PuBEc8b0n6IdnfSNuLD3MdZV16MeFlOBufssSYMFYw
+-> ssh-rsa f5THog
+no/TxwjEI4Py20KltBAy5724hmqGcD4vk6H+/zJwnyrHi/x0zFaUxrMVj5dAzpbj
+OQ0c+ZhA6hdgZHfxYEorZ9yPdktGO2psIAwhr52aJBvoP4jMbPXwU55Htgkhsu7q
+fT2wEXZ8xmmmNLnpUyP1VWDo5gcS6Z2fCSheTQ3xxze06vll5LAsu2UtED8P997C
+Mj29ZTVsu5a44jlvFSyT9g/gYxa1iietbuftFlziQ8cs3BjKuC6BtT1ag0J0O3iN
+k07AHX5NTKDB/+J5jKJqkpI2WEPlX2B4S/QXIcYlscFVZzWcaZKBXLoYThug4K1D
+iZzdzpXVk0cQdAzvc0VQmwrqT588QlEL64N8lYJqWhtkZ5UmsF1BW+mshM3PVYq4
+W08JbX0FQVf39kz9znnD4EZBi71OPXIGu7CTS7Zuuf2vWRC7KFSjm8Cn04Sslgsw
+WgPYL1BiBydh6fi6GOgqYuCIS5bqKI/WRympDVdZrg5Qa3AuMqMSkJWFPNi9vFxj
+zBnbV3MMFkWQrflkYTA2R1V5ypOKPt3JzPuPEAVGMmcJgJEcdYddK8XW2kwkpAxn
+P92RGhXcOWGlW6Ewel4ZrQj/WJ5jkkb4nNJwHh2LM1ndg2yyLol80095xJIvdb0b
+DdNZwzYj5/1QFL2yWACn/ro0LKWopdZ9QNuT2NDd078
+-> ssh-rsa kFDS0A
+kg3XLJdohDsGweoS7MAcoVkgEMFvakjubweaLPdbuoxVOTiwCW1ldx84PZeJ3UeU
+RlavoNjdj70J2/w9+8aTU/gvG1PUUB2cdnlxfQoFdhKutBWXYie9tpc5BrtCNXRf
+tavMj3BSoIBybT/O7BrxEvdcF9JpKo3tenkL1wj4jb5ZXjciAkXCY8luJL3odWqs
+gK0RBpof7wO5O1pA7HrZ1ydOTci+1F90K/OF1ZulTtFSnnsg3AI9IrtSnnoyHe4d
+4CoilS4/gduwXFJCJwTUw0fGHY2IlziXLEDjk7a83o/xrQLjGWxB0TYKYfu1IqLT
+uRSYmLaqYfz9Et/ydKYt3db8BjZGlnEplXt4LagJcxpqqx4ABB7JLOSU43h1aolJ
+FbtKgkP8nZ1VhCjC1BMaZYRuN6qoxilwF+5XonlZoJpgev563BqCqjiZ+fipIlSy
+m5nugad4QLBE3S+xQo9fACJ335nGxFlQuKXlNry1MrXgF6gOVruGwE3LAwUGf28a
+wAA8ZzK3d5kLlWLY8WFkrHqkUha6JLbCQBMHc1Tkpk7fDd1/qRTnBXkeGPyFEyAs
+BA0rDAlVPPhEdQBHnd3Mwh2HhBG8qida5vzuwKhAx80Ov2Hkwin1eq/YTHSyN90v
+fVXds1K7QUL6zfMNgU/9QMnz22LBngA5VkutQyKiM4c
+-> piv-p256 vRzPNw AmbHFMV9TwFQUSUuz/tQ/f2kR20GpfDRQ/CWXy1U0His
+6VYIOwBLAJ499kzawdMLRTh8QBCrzW22sySYnPS2VqI
+-> piv-p256 zqq/iw Aoda7pqkfajYWFMGdLK+Y2x0bF4tMVkt9MlD4wC2zuHw
+2Z+EuWy03GDP/t2qajXDA7FYDj0SK+pQPvoEA3QqO+o
+-> ssh-ed25519 YFSOsg fjUdIZt2ya1ZW2eIJV3Pgn6pmSZA6RURSmh0rUoDCi4
+VJrUpAivw/ONNClZ6HJ7AYYuALwvspnCuxkEb+2j2Zk
+-> ssh-ed25519 iHV63A h+kfJlALWjDid03d6u+Rf7I/qAvx+YCLwusdV4AFKzo
+bwsWadclbvcawCxs8U6hT9HuydAJwSLUFf52rRx3PDM
+-> ssh-ed25519 BVsyTA dAv36iQW7LnW6Z5bN5dFZUDN2u0P7KzlRMXoJBGLtTI
+vcnNvAzudhY84xLR5NVn3maZdSUcozhp9fHa1EN241c
+-> ssh-ed25519 +3V2lQ qVlbT/zdlSnw+oTbvC4HenX2/hMRn1rNYxKy7pMR4xQ
+nJvuQCx77ZIb9RFoI8i32ldCF16NE6536Xci7SsRo+w
+--- cFeudDrhpP2OwSm5XnCENPesMd0UuKjA+JrKO3ww3Ik
+¯|æŸ<1D>ĸÛÙ©ÊÆNáÛñú=Mv§]Öµè¦Týäü­Å­QFàV
äÓ8[llÈcPÄóŸìEÛÏe

secrets/tt-rss-smtp-password.age

@@ -0,0 +1,44 @@
+age-encryption.org/v1
+-> ssh-ed25519 iDKjwg pAt6cdBY35HujSrTlJ7UYuOKzQnfGGIvL1pEqHjV5lI
+w2GOJ6+ZB8E+oUgw8ITPF+6M2lqEq8iPncbMUvyuqkI
+-> ssh-ed25519 uYcDNw iNkFRWrIyITfu7CVNL0dpjVdRTH/PtO6Q83NSS8p4GM
+GJeHWGZA+Si6BxJkB0BgOvHZIEuq1nRV65SIcTRPa9s
+-> ssh-rsa f5THog
+MJJfrlgsVIZ7XFC4xsnvUE0P6iDd708IOuFq/V6Ad33+KU1J5pVIoYitvGAh3sVd
+ONfphIwTSTdwIoRVwgBLE/E9YRIBcSx56lVvpIr3Jy65hOODIhvQJySlmc1IcLWr
+09KsP9s5AZLgqu0JFYQAPkzkUGcvvwW/vrF/N20IeTrjsjAuI80k5SK9R8aaO0ow
+/z4gxcUT80LByQtXrRB33uCezrN6qBfOqWr9Xaj1QXFvSp6iHpuQoheVCQZYL3si
+tR5gd7f/3fK3wBX930uJsDjddIeStCK5VLbz51ju/bo09wRTm6X+qv411Va/TeF5
+xTBpIzdHB5i8u8TmhJOnNsc/RCN9UVlDhwdJeh+SoIr4UxkPN2BbUOzzr7xLAI/k
+DUoosEYcYrUAcFCacV2AjmTh4x8qlN/h/zq76eQZMZnAYhbYbGvsyV+6udGfRnis
+WyfmD13KWzUwmAbrREPILKK470CMsAQTyS+cebu52Zj5RUEx7t6z+v3yjik1G4Nx
+ETZ+ir6R9M9T0LGTM4xr/tjMYL6UoEBJrWWTvjVlYEfGjDZc/yVNuw/2ZHn5uiyX
+ikPf9PEWyNQ6Ak06wg/Tm2ZXttSn8ZbidFFC7G8lTEfZ7UH9/yl91WRDirhaXdP2
+008WUd7phcr45SDoKWmCqJnY/+fYb+xTl8L9c+5rVQc
+-> ssh-rsa kFDS0A
+SQdT604GhPGeBW9vzldW6UM3SkEcKnqZBFQb7/DwiwjkXr5lIujk45BQaTcnysZP
+NSkVOgplFkMIV+ERRTRyY9xzLXib8rri+9GpCcwR/8iUH2FpqzcYWD+Hibworv1s
+u+87Q5ES4gkTyT8z1huZfGw8t2YyvXGFYAG/lh1wUZEIhEH9TeAUQ/U1CNBey1TH
+nS28d9JDNxZ0lBy3O8mCBoV220eqcqIPBOFIwPQ9pHLuQLCGt9F2UmLg4OKFsm3v
+mrLgZ4g6tNN7nx483JZBNn9yoXkZjQGAf6TqSL4Xq57Cmyye0hrusw4RBu9cqR+U
+7bLyiwx2bnouxfbCyJAQCUGTblcrT9YxrjuPTypVU0KtATUBqZg5xkEFMXfgrvdt
+JXSiWBEc9M3X1aLjz0NuY03ild5C2iio75qvlIYLfd7+A+MYykV1nU+zTvAnShBN
+ICfaDwERSNXYl8fdZiDlJRERp6QK89cN5edAR1k1mRZTRORW11mohZeUcYpOgpFP
+mXVtM6SXE04KaNpMSzCu1Q5x1SBgqLLN9OmMu9fJJJTKFLDjKwh+UEOYnoABocCb
+0D79qi79MLbQiU0kBJCnyAGif0Ubo2LnZHSLByvQmgy8IP3ju+Y3eFCPOwCcliod
+mMVhOG4rZEqeSVR0r8YYGmZixGIX9S91RGBK6JSxu4g
+-> piv-p256 vRzPNw AnDoZYlrepm4PU4gQE5xksvnMH8WhDkuYYc5JWRx00L1
+tiFbNGmOm1H61+f0CNZ+zPMY8rSn7WVHGRNmTv+CRow
+-> piv-p256 zqq/iw Au0h6ht1TTb9nqe535mwE40CgW5gfHXuAUp/wy/KBTl4
+oD1LERP26MGytCMRy+izv36Ab7fCpmQgbEsHR+pFHbE
+-> ssh-ed25519 YFSOsg decVvkaZOJABhw/lhAV0Euj2ZN27v0D6jbMvJHsO8Qk
+AYu9fQ7DhmMTnHFxoq0VKKZZ140TxRCrGQWe8+PW+KU
+-> ssh-ed25519 iHV63A WxljUIeZZ0dna8wKXCEO9vvDiYTZ60gn+wk5VvdExxE
+BIBsuXgJZXmzYgpQsMRnrAXYR9LljiNB0iwdx4HVKxc
+-> ssh-ed25519 BVsyTA Ekwc1+2vUMN42CdItNPXW+f9GRAjt68mTXw/XdAFQUA
+D8jnEqCKk0nkiwh53ZbhaUa/uf7/DYqRCfRYoPq2nJI
+-> ssh-ed25519 +3V2lQ Yd67WpOq9Xeg2i5j+uAH05PfRg9ODKk0HY5sV+E9Ugs
+3MKwp0TZ0HXGX1wsbkmqvhJSPS4CMf5aOFGU1avqqa8
+--- jvHBNW8EVAgIPXUnRCBA9XGH5inT/OTXttPLo8MawJY
+Öì¿ít’1açÖñõ
+0BNëõ$(éÍÿ«lýŠN&{Q¿„´Qÿ¨Fk­4»

terraform/dns.tf

@@ -84,6 +84,11 @@ resource "namecheap_domain_records" "pub-solar" {
     type     = "CNAME"
     address  = "nachtigall.pub.solar."
   }
+  record {
+    hostname = "rss"
+    type     = "CNAME"
+    address  = "nachtigall.pub.solar."
+  }
   record {
     hostname = "stream"
     type     = "CNAME"