From 9075c97ce88bc314a1b0567eafdbc969a9f55c54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Leon=20Schwarz=C3=A4ugl?=
 <leon.schwarzaeugl@imba.oeaw.ac.at>
Date: Sun, 29 Jun 2025 15:38:57 +0200
Subject: [PATCH] feat: add shlink

---
 SwarselSystems.org                  | 82 +++++++++++++++++++++++++++++
 modules/nixos/server/shlink.nix     | 73 +++++++++++++++++++++++++
 profiles/nixos/moonside/default.nix |  1 +
 3 files changed, 156 insertions(+)
 create mode 100644 modules/nixos/server/shlink.nix

diff --git a/SwarselSystems.org b/SwarselSystems.org
index b126a22..6918930 100644
--- a/SwarselSystems.org
+++ b/SwarselSystems.org
@@ -4770,6 +4770,7 @@ Modules that need to be loaded on the NixOS level. Note that these will not be a
             oauth2Proxy = lib.mkDefault true;
             croc = lib.mkDefault true;
             microbin = lib.mkDefault true;
+            shlink = lib.mkDefault true;
           };
         };
       };
@@ -10986,6 +10987,87 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
   }
 #+end_src
 
+**** shlink
+:PROPERTIES:
+:CUSTOM_ID: h:4ccdcd5c-a4dd-49e4-94e7-d81db970059c
+:END:
+
+#+begin_src nix :tangle modules/nixos/server/shlink.nix
+  { lib, config, ... }:
+  let
+    serviceDomain = "s.swarsel.win";
+    servicePort = 8081;
+    serviceName = "shlink";
+    containerRev = "sha256:1a697baca56ab8821783e0ce53eb4fb22e51bb66749ec50581adc0cb6d031d7a";
+  in
+  {
+    options = {
+      swarselsystems.modules.server."${serviceName}" = lib.mkEnableOption "enable ${serviceName} on server";
+    };
+    config = lib.mkIf config.swarselsystems.modules.server."${serviceName}" {
+
+      sops = {
+        secrets = {
+          shlink-api = {  };
+        };
+
+        templates = {
+          "shlink-env" = {
+            content = ''
+              INITIAL_API_KEY=${config.sops.placeholder.shlink-api}
+            '';
+          };
+        };
+      };
+
+      virtualisation.oci-containers.containers."shlink" = {
+        image = "shlinkio/shlink@${containerRev}";
+        environment = {
+          "DEFAULT_DOMAIN" = serviceDomain;
+          "PORT" = "${builtins.toString servicePort}";
+          "USE_HTTPS" = "false";
+          "DEFAULT_SHORT_CODES_LENGTH" = "4";
+          "WEB_WORKER_NUM" = "1";
+          "TASK_WORKER_NUM" = "1";
+        };
+        environmentFiles = [
+          config.sops.templates.shlink-env.path
+        ];
+        ports = [ "${builtins.toString servicePort}:${builtins.toString servicePort}" ];
+        volumes = [ ];
+      };
+
+      networking.firewall.allowedTCPPorts = [ servicePort ];
+
+      environment.persistence."/persist".directories = lib.mkIf config.swarselsystems.isImpermanence [
+        { directory = "/var/lib/containers"; }
+      ];
+
+      services.nginx = {
+        upstreams = {
+          "${serviceName}" = {
+            servers = {
+              "localhost:${builtins.toString servicePort}" = { };
+            };
+          };
+        };
+        virtualHosts = {
+          "${serviceDomain}" = {
+            enableACME = true;
+            forceSSL = true;
+            acmeRoot = null;
+            locations = {
+              "/" = {
+                proxyPass = "http://${serviceName}";
+              };
+            };
+          };
+        };
+      };
+    };
+  }
+#+end_src
+
 *** Darwin
 :PROPERTIES:
 :CUSTOM_ID: h:ac0cd8b3-06cf-4dca-ba73-6100c8fedb47
diff --git a/modules/nixos/server/shlink.nix b/modules/nixos/server/shlink.nix
new file mode 100644
index 0000000..6ec8a25
--- /dev/null
+++ b/modules/nixos/server/shlink.nix
@@ -0,0 +1,73 @@
+{ lib, config, ... }:
+let
+  serviceDomain = "s.swarsel.win";
+  servicePort = 8081;
+  serviceName = "shlink";
+  containerRev = "sha256:1a697baca56ab8821783e0ce53eb4fb22e51bb66749ec50581adc0cb6d031d7a";
+in
+{
+  options = {
+    swarselsystems.modules.server."${serviceName}" = lib.mkEnableOption "enable ${serviceName} on server";
+  };
+  config = lib.mkIf config.swarselsystems.modules.server."${serviceName}" {
+
+    sops = {
+      secrets = {
+        shlink-api = { };
+      };
+
+      templates = {
+        "shlink-env" = {
+          content = ''
+            INITIAL_API_KEY=${config.sops.placeholder.shlink-api}
+          '';
+        };
+      };
+    };
+
+    virtualisation.oci-containers.containers."shlink" = {
+      image = "shlinkio/shlink@${containerRev}";
+      environment = {
+        "DEFAULT_DOMAIN" = serviceDomain;
+        "PORT" = "${builtins.toString servicePort}";
+        "USE_HTTPS" = "false";
+        "DEFAULT_SHORT_CODES_LENGTH" = "4";
+        "WEB_WORKER_NUM" = "1";
+        "TASK_WORKER_NUM" = "1";
+      };
+      environmentFiles = [
+        config.sops.templates.shlink-env.path
+      ];
+      ports = [ "${builtins.toString servicePort}:${builtins.toString servicePort}" ];
+      volumes = [ ];
+    };
+
+    networking.firewall.allowedTCPPorts = [ servicePort ];
+
+    environment.persistence."/persist".directories = lib.mkIf config.swarselsystems.isImpermanence [
+      { directory = "/var/lib/containers"; }
+    ];
+
+    services.nginx = {
+      upstreams = {
+        "${serviceName}" = {
+          servers = {
+            "localhost:${builtins.toString servicePort}" = { };
+          };
+        };
+      };
+      virtualHosts = {
+        "${serviceDomain}" = {
+          enableACME = true;
+          forceSSL = true;
+          acmeRoot = null;
+          locations = {
+            "/" = {
+              proxyPass = "http://${serviceName}";
+            };
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/profiles/nixos/moonside/default.nix b/profiles/nixos/moonside/default.nix
index 4d094e2..0ea9d47 100644
--- a/profiles/nixos/moonside/default.nix
+++ b/profiles/nixos/moonside/default.nix
@@ -21,6 +21,7 @@
           oauth2Proxy = lib.mkDefault true;
           croc = lib.mkDefault true;
           microbin = lib.mkDefault true;
+          shlink = lib.mkDefault true;
         };
       };
     };