fae: add vikunja

hosts/fae/default.nix

@@ -4,6 +4,7 @@
     ./actual.nix
     ./paperless.nix
     ./invoiceplane.nix
+    ./vikunja.nix
     ./fae.nix
   ];
 }

hosts/fae/vikunja.nix

@@ -0,0 +1,37 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in
+{
+  age.secrets.vikunja-secret-env = {
+    file = "${flake.self}/secrets/vikunja-secret-env.age";
+    mode = "400";
+    owner = "vikunja";
+  };
+
+  security.acme.certs = {
+    "viku.faenix.eu" = { };
+  };
+
+  services.nginx.virtualHosts = {
+    "viku.faenix.eu" = {
+      forceSSL = true;
+      useACMEHost = "viku.faenix.eu";
+      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.vikunja.port}";
+    };
+  };
+
+  services.vikunja = {
+    enable = true;
+    frontendScheme = "https";
+    frontendHostname = "viku.faenix.eu";
+    environmentFiles = [ config.age.secrets."vikunja-secret-env".path ];
+  };
+}

secrets/secrets.nix

@@ -42,4 +42,9 @@ in
     users.teutat3s
     users.teutat3s-5-nfc
   ];
+  "vikunja-secret-env.age".publicKeys = [
+    machines.fae
+    users.teutat3s
+    users.teutat3s-5-nfc
+  ];
 }

secrets/vikunja-secret-env.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 P2sgew gaS2H1hExnxJwIZMEJeuFMIA2a9xOCfg2nXhd4h0dF8
+Rco//RzvvlMOjtlXoJxN/dCXQzL8uqLrvWag5Sjpae4
+-> ssh-ed25519 BVsyTA F5j277roMmsjxEPiYdgqIgsrdZISTDJlyFvUsS0EYzA
+AirKnvaHnwZLtB3XEtf1f1CrAtUQRsDXa+9noz7ricY
+-> piv-p256 xGzyzw A2HdwWrgUnK1iOHRZriavJtwcefyyi/qEPDpYxCRIBPA
+Y0x3o4Qt+A0Vx7cJtpeWD+ntz7n9W+8+r5esq8bAyro
+--- YWKAYYv6tL9HMhG7mO/T/co/li+A4hLRznAQ+qZUVUo
+ÞÚ.@rË	
äÛÁ®U‚Õ>rÅÞÉbÓ§28Ù?<3F>¢»f÷ª•3“Ö‡í<E280A1>Õ»"9JÍx­7Öˆ72Yéûy¿qíå)yUè åJÆÝrF£Ìݵ}šÂxâZ7Ëà;yq=”U»p