[containers] Update a bunch of containers.

system/hosts/mcp/containers/pocket-id.nix

@@ -1,5 +1,5 @@
 { config, ... }:
-let 
+let
   inherit (import ./lib.nix config) mkContainer blazestar;
   # The default is to run on port 80, which the pocket-id user cannot bind to.
   # We need a different port to be able to serve traffic.
@@ -8,11 +8,28 @@ let
   # - 3000: Web UI
   # - 2019: Admin endpoint
   port = 8888;
+  encryption_key = "pocket-id/encryption_key";
 in
 {
+
+  sops.secrets = {
+    "${encryption_key}" = {
+      restartUnits = [ "${config.local.container-backend}-pocket-id.service" ];
+      mode = "0400";
+      owner = "pocket-id";
+    };
+  };
+
+  sops.templates."pocket-id.env" = {
+    content = ''
+      ENCRYPTION_KEY=${config.sops.placeholder."${encryption_key}"}
+    '';
+    owner = "pocket-id";
+  };
+
   virtualisation.oci-containers.containers.pocket-id = mkContainer {
     image = "ghcr.io/pocket-id/pocket-id";
-    dependsOn = [];
+    dependsOn = [ ];
     hostName = "auth";
     port = port;
     public = false;
@@ -24,17 +41,20 @@ in
       description = "Pocket ID Auth Server";
     };
     volumes = [
-      "/tank/pocket-id/data:/app/backend/data"
+      "/tank/pocket-id/data:/app/data"
     ];
     environment = {
-      PUBLIC_APP_URL = "https://auth.${blazestar}";
+      APP_URL = "https://auth.${blazestar}";
       # Whether the app is behind a reverse proxy.
-      TRUST_PROXY = "false";
-      CADDY_PORT = toString port;
+      TRUST_PROXY = "true";
+      PORT = toString port;
       # PORT = "3000"; # Frontend port
       # BACKEND_PORT = "8080"; # Backend port
       PUID = toString config.users.users."pocket-id".uid;
       PGID = toString config.users.groups."pocket-id".gid;
     };
+    environmentFiles = [
+      config.sops.templates."pocket-id.env".path
+    ];
   };
 }