61 lines
1.6 KiB
Nix
61 lines
1.6 KiB
Nix
{ config, ... }:
|
|
let
|
|
inherit (import ./lib.nix config) mkContainer blazestar;
|
|
# The default is to run on port 80, which the pocket-id user cannot bind to.
|
|
# We need a different port to be able to serve traffic.
|
|
# The following ports in the container are already taken:
|
|
# - 8080: API
|
|
# - 3000: Web UI
|
|
# - 2019: Admin endpoint
|
|
port = 8888;
|
|
encryption_key = "pocket-id/encryption_key";
|
|
in
|
|
{
|
|
|
|
sops.secrets = {
|
|
"${encryption_key}" = {
|
|
restartUnits = [ "${config.local.container-backend}-pocket-id.service" ];
|
|
mode = "0400";
|
|
owner = "pocket-id";
|
|
};
|
|
};
|
|
|
|
sops.templates."pocket-id.env" = {
|
|
content = ''
|
|
ENCRYPTION_KEY=${config.sops.placeholder."${encryption_key}"}
|
|
'';
|
|
owner = "pocket-id";
|
|
};
|
|
|
|
virtualisation.oci-containers.containers.pocket-id = mkContainer {
|
|
image = "ghcr.io/pocket-id/pocket-id";
|
|
dependsOn = [ ];
|
|
hostName = "auth";
|
|
port = port;
|
|
public = false;
|
|
domain = blazestar;
|
|
homepageOpts = {
|
|
group = "Infra";
|
|
name = "Pocket ID";
|
|
icon = "pocket-id";
|
|
description = "Pocket ID Auth Server";
|
|
};
|
|
volumes = [
|
|
"/tank/pocket-id/data:/app/data"
|
|
];
|
|
environment = {
|
|
APP_URL = "https://auth.${blazestar}";
|
|
# Whether the app is behind a reverse proxy.
|
|
TRUST_PROXY = "true";
|
|
PORT = toString port;
|
|
# PORT = "3000"; # Frontend port
|
|
# BACKEND_PORT = "8080"; # Backend port
|
|
PUID = toString config.users.users."pocket-id".uid;
|
|
PGID = toString config.users.groups."pocket-id".gid;
|
|
};
|
|
environmentFiles = [
|
|
config.sops.templates."pocket-id.env".path
|
|
];
|
|
};
|
|
}
|