feat: freshrss and minor adjustments

profiles/server/nixos/default.nix

@@ -36,5 +36,6 @@ in
     ./emacs.nix
     ./forgejo.nix
     ./ankisync.nix
+    ./freshrss.nix
   ];
 }

profiles/server/nixos/emacs.nix

@@ -10,23 +10,6 @@
       startWithGraphical = false;
     };
 
-    services.nginx = {
-      virtualHosts = {
-        "signpost.swarsel.win" = {
-          enableACME = false;
-          forceSSL = false;
-          acmeRoot = null;
-          locations = {
-            "/" = {
-              proxyPass = "http://localhost:9812";
-              extraConfig = ''
-                client_max_body_size 0;
-              '';
-            };
-          };
-        };
-      };
-    };
   };
 
 }

profiles/server/nixos/freshrss.nix

@@ -0,0 +1,36 @@
+{ lib, config, ... }:
+{
+  config = lib.mkIf config.swarselsystems.server.freshrss {
+
+    users.users.freshrss = {
+      extraGroups = [ "users" ];
+      group = "freshrss";
+      isSystemUser = true;
+    };
+
+    users.groups.freshrss = { };
+
+    sops.secrets.fresh = { owner = "freshrss"; };
+
+    services.freshrss = {
+      enable = true;
+      virtualHost = "signpost.swarsel.win";
+      baseUrl = "https://signpost.swarsel.win";
+      # authType = "none";
+      dataDir = "/Vault/data/tt-rss";
+      defaultUser = "Swarsel";
+      passwordFile = config.sops.secrets.fresh.path;
+    };
+
+    services.nginx = {
+      virtualHosts = {
+        "signpost.swarsel.win" = {
+          enableACME = true;
+          forceSSL = true;
+          acmeRoot = null;
+        };
+      };
+    };
+  };
+
+}