From a0175f565bd07dcade50fc431660c0d37152efc3 Mon Sep 17 00:00:00 2001
From: "Thomas A. Christensen II" <25492070+MillironX@users.noreply.github.com>
Date: Mon, 8 Dec 2025 08:11:43 -0600
Subject: [PATCH 1/2] secrets! (pihole): Remove pihole secrets

---
 secrets.nix        |   1 -
 secrets/pihole.age | Bin 926 -> 0 bytes
 2 files changed, 1 deletion(-)
 delete mode 100644 secrets/pihole.age

diff --git a/secrets.nix b/secrets.nix
index 8042bf6..1e0ec3d 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -36,5 +36,4 @@ in {
     ++ [ corianne-host ];
   "secrets/network-information.age".publicKeys = system-administrators
     ++ [ bosephus-host ];
-  "secrets/pihole.age".publicKeys = system-administrators ++ [ bosephus-host ];
 }
diff --git a/secrets/pihole.age b/secrets/pihole.age
deleted file mode 100644
index 1b2bc2533d7d7de5063e15de08cacfa0e5dd6df6..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 926
zcmZ9~ON-nD003YWtr$u@C<-EMEXr2Hn8#!?31T6WWL}x<Bs-Z*CVFVH$t0P{V`lQs
z!HOV@h$2-FJrsme6&DYMLbW}&;ufT!trTH<5QQSLx{CO~*Li-yclmVNs#w9+vY5wi
z7(5#;Z8$}N%5gA?oQh>)wHiu+u2=O+39LsdRK+FNAr|z)>7yg5R_Y5XYpTwKC@i|0
zm>2{Jbij0gVmR{R$;MKx8y=gND(0nem`}D~8mAS7bV!j+JYSbvD!!_rHk@Y}NT%gR
zOET+xPfU=sn&Jr5@3mQaG%gV_o;75@KmwYe)DZ_jnrT~^fv~fd7(`U*aHY??lB*y-
z7fG_0W0P^jNDMlZRyEV$t#$?msJa|8@kGvL&K^u6NNfhI-W7UXVkD5c&?hw8@1>~5
zMSwA(>3HcYbr&(Z2s(os94^o%PY(K##3-8?O2(eUY_=F~RjV$<II%&i0Y@f36uPwC
zpo(^AZt<vzWHu`%ET##gR=~Rm6vpx(0^+%+82n^mxK`Ajg)SMZ1f1~$vlC=`SC4gG
zZdUnlhHsFo8Z>LTP6lee#<rBcl(obLT+lsCPlpp_DGc~VNh6fNbrvZ_akhm<Kp080
zP{dqmk@Q2iugptnq_dR6R<Y4YpZjC3ELm4JJafFNO$~(ZNnp$D&dH$TQIxN>1(c{c
zbvDlXP>h>Q(ZHJ`yy#a`KB#*gAi%Q0R^rQ1b%<G+Zq1l+Gs#0KL5)G#@p(08m9QhL
zLGk~RN(HRtEhXtTmT;F9v1wD)<Tj;Rj@ryEjmR}R!=^qwklI-t0d~Iq;@q*1AHVhd
zy%+b_K08Q%Ie35jn}_dT|1#qD|9S2FN5a)#U%vAM_Qrd~^2qIF0oC_5p+nqn*U=5;
z)b>j+97Ue9&K$chfAp+!&jp*<d*!-bUORa}pPbfD9C`86ugCl1ci^AL&&<IGxb4MS
z8#?#aT2382`Q{J!`9r5JzjODyCraa1`{&(1oSmBw{&Zt^o%{Pz_*n4o=ZBBh+&jwV
sUpwoMeDXc;(5t6AcU}Db$FE+0`bzcoGrheJ&Q9gGi`{FdpZf6de<06F761SM


From ed495148c14c4490e3cee9eaa0cb02c36b1bf946 Mon Sep 17 00:00:00 2001
From: "Thomas A. Christensen II" <25492070+MillironX@users.noreply.github.com>
Date: Mon, 8 Dec 2025 14:44:22 -0600
Subject: [PATCH 2/2] service (freshrss): Add freshrss service

---
 secrets.nix               |   2 +
 secrets/freshrss.toml.age | Bin 0 -> 1285 bytes
 services/freshrss.nix     | 136 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 138 insertions(+)
 create mode 100644 secrets/freshrss.toml.age
 create mode 100644 services/freshrss.nix

diff --git a/secrets.nix b/secrets.nix
index 1e0ec3d..45783ee 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -34,6 +34,8 @@ in {
     ++ [ mcentire-host ];
   "secrets/darwin-policies-json.age".publicKeys = system-administrators
     ++ [ corianne-host ];
+  "secrets/freshrss.toml.age".publicKeys = system-administrators
+    ++ [ mcentire-host ];
   "secrets/network-information.age".publicKeys = system-administrators
     ++ [ bosephus-host ];
 }
diff --git a/secrets/freshrss.toml.age b/secrets/freshrss.toml.age
new file mode 100644
index 0000000000000000000000000000000000000000..9bfa06c148bbaa685ffb520116db0ee1f6964663
GIT binary patch
literal 1285
zcmZY2`)?Bk003YE1h+0LkPQeLvQlLul+s<>>w~~d*Vnb(wY^@i*DEB@_O93V+Fl>m
z_O1}ZcuaJX06N$phz`ic28huOofE?VB`{FKQwL)Rh%BNI351z|zt8U<_<}Sgr&8gp
zkmh1+YAKtg6$L;fZ;<42Q8`5_K@iYOVhL5Egh+5ZWR{V>dV?1=nMnc9vj!~;<aolC
zH3TSLm-gYj&FT+;K30^>CyPF7AcE;&1>nuFkTpm|DK(6zQjkfb#bYsb#AhaC8YeP&
z184<bEJ{!h%PUL;LYIUDR3EmPvKl&*iA5dWv?^7f=7hM+k<8{)egF|ch$)_80wK;!
zmkJq10je`T9o@wFSww-x-Hn!{0i&bAkXa8;-pG)Hf{GG#2?baPb+b{KInB5NX$uOv
zRS77buFqOcid@N*ZxRxEzp_3jQZTeR)kJz+yvr0+IdyI{;-pzlt>GiQkn}1IM&1!g
z(s`$hnY^hoZZ1ztQZa)kX15@KTL|d+JVXSnc8$ZU5Fp-)+9^C+G5}FK0t()u$l{H8
zG0usg@w7HU>5^_ISO}|1O)hHyRbiNqF*t(OFbC)hhRK_ZX^cgSlAswQ^C}Sb+qsm+
zqq8WIE~}fisC{G(H1nWK<z%oz*n)&(tjOb(Q655XgfYtOY6R%U5?3-g0&1LQiU6T2
zhByi~`Poq1ulwI-tj9gHg!NkxD36nFS)ODFf$`g&KEz0v@)mvCPaw2S;j+h+_N+Ro
z7Fked2#6~|1Wq6UC?9nQD3M7Tl`71q)9P|~E(r2|SlQ^Haw550E^#qd!LJP2TyPA;
z^O#xhG1gOr-J?cOJIdjB&SSQxF%Rk@Y0*mZ9$fQkaL1@s*8k6|%#U^3kn^jn%g5S&
zX5>=wmdNhYWox0aaao1<SqEyGXe-?sY`*wX^yQT9meQun!e_>QpEx?TaAfU*<@-xp
zryUvWyDoivC)Kos+jmiPue-NXc-8UA=5s?2?q3)^<*Vr)t6kGvR&`6%I<$8721RGb
zgY8xC{C(o=)xU23AdYW&Ffn!JiMmbAvtGRAxqa~clM%XX&Unq6W5S_@<#Q@$x1oF6
z;kS3xZDTIANc;NEzo<Cl89BFoReNpSvw8iSd!awR>KR#=K74Iy*tzx3Wz(J?95txP
z*H=tH^FzH=ElLA19T;9w=W5HooNwI!FwwIP*0=v#`Au4~NlARP5c^f~^}XD;$yI@^
z8%OR|HY@gYtlz19a`W1THBY;O15(>}AUI0y>FkQOFOrR2s>Jp&ORML~-S&-VD#q!>
zTgJ8rrkovqI*~b=71e-Di}X-gZ|~-nktJ<|Aw>MSY{u}48T}tb$_K9Y3?T2mH@Bhr
zy0$vK$hoMZ0%s*>_`|(#M5T|92bcXOJ{+3zu=~leN4t-Yw@e>CG0_;~X4Xmf+O+LM
zP4TV+8l&y<n&MvF-RI`-Z&d%(fBVt$W2bvO36Uew+<JET{h^%)B6ok0?;4rcN_H+j
ziQlTea_V5k2jW>JXZO){*uaxJ>ve-XzT=C^2`hQ!M(zAQ)9MCl+5)(?A!}{j1rD@7
YLKB}BFMJ%nQT5@0^545&+b<sc4|Y@bIRF3v

literal 0
HcmV?d00001

diff --git a/services/freshrss.nix b/services/freshrss.nix
new file mode 100644
index 0000000..4832ebe
--- /dev/null
+++ b/services/freshrss.nix
@@ -0,0 +1,136 @@
+{ config, pkgs, home-manager-quadlet-nix, ... }:
+
+let
+  user = "freshrss";
+  port = "37374";
+  stateDirectory = "/var/lib/freshrss";
+  serviceContainer = "freshrss";
+  stateSubDir = subDir: "${stateDirectory}/${subDir}";
+  createTmpfilesRule = subDir: "d ${stateSubDir subDir} 1755 ${user} ${user}";
+  volumeMount = subDir: bindDir: "${stateDirectory}/${subDir}:${bindDir}:U";
+
+  dbDirectories = [ "database" ];
+  serviceDirectories = [ ];
+in {
+  age.secrets = {
+    "freshrss.toml" = {
+      file = ./../secrets/freshrss.toml.age;
+      owner = "${user}";
+    };
+  };
+
+  millironx.podman-secrets.freshrss = {
+    user = "${user}";
+    secrets-files = [ config.age.secrets."freshrss.toml".path ];
+  };
+
+  services.caddy.virtualHosts."feeds.millironx.com".extraConfig = ''
+    reverse_proxy http://127.0.0.1:${port}
+  '';
+
+  systemd.tmpfiles.rules = builtins.map createTmpfilesRule
+    ([ stateDirectory ] ++ dbDirectories ++ serviceDirectories);
+
+  services.borgmatic.configurations."${config.networking.hostName}" = {
+    source_directories = builtins.map stateSubDir dbDirectories;
+
+    name = serviceContainer;
+    psql_command =
+      "/run/wrappers/bin/sudo -iu ${user} ${pkgs.podman}/bin/podman exec ${serviceContainer}-db psql --username=${user}";
+    pg_dump_command =
+      "/run/wrappers/bin/sudo -iu ${user} ${pkgs.podman}/bin/podman exec ${serviceContainer}-db pg_dump --username=${user}";
+    pg_restore_command =
+      "/run/wrappers/bin/sudo -iu ${user} ${pkgs.podman}/bin/podman exec ${serviceContainer}-db pg_restore --username=${user}";
+  };
+
+  users.users."${user}" = {
+    group = "${user}";
+    isNormalUser = true;
+    home = "${stateDirectory}";
+    createHome = true;
+    linger = true;
+    autoSubUidGidRange = true;
+  };
+  users.groups."${user}" = { };
+
+  home-manager.users."${user}" = { config, osConfig, ... }: {
+    imports = [ home-manager-quadlet-nix ];
+
+    home.stateVersion = "25.05";
+
+    virtualisation.quadlet = let
+      inherit (config.virtualisation.quadlet) containers;
+      inherit (config.virtualisation.quadlet) networks;
+      secrets = osConfig.millironx.podman-secrets.freshrss;
+
+    in {
+      containers = {
+        "${serviceContainer}-db" = {
+          autoStart = true;
+          containerConfig = {
+            image = "docker.io/library/postgres:16";
+            environments = {
+              POSTGRES_DB = "${user}";
+              POSTGRES_USER = "${user}";
+            };
+            secrets = [
+              "POSTGRES_PASSWORD,type=env"
+              "POSTGRES_PASSWORD,type=env,target=PGPASSWORD"
+            ];
+            healthCmd = "pg_isready -d $\${POSTGRES_DB} -U $\${POSTGRES_USER}";
+            healthInterval = "30s";
+            healthRetries = 5;
+            healthStartPeriod = "20s";
+            volumes = pkgs.lib.imap0 (i: sub:
+              volumeMount sub
+              (builtins.elemAt [ "/var/lib/postgresql/data" ] i)) dbDirectories;
+            networks = [ networks."${serviceContainer}".ref ];
+          };
+          unitConfig.Requires = [ secrets.ref ];
+          unitConfig.After = [ secrets.ref ];
+        };
+
+        "${serviceContainer}" = {
+          autoStart = true;
+          containerConfig = {
+            image = "docker.io/freshrss/freshrss:1";
+            environments = {
+              TZ = osConfig.time.timeZone;
+              CRON_MIN = "2,32";
+              LISTEN = "0.0.0.0:${port}";
+              OIDC_ENABLED = "1";
+              FRESHRSS_INSTALL = ''
+                --api-enabled
+                --base-url
+                --db-base $''${DB_BASE}
+                --db-host $''${DB_HOST}
+                --db-password $''${DB_PASSWORD}
+                --db-type pgsql
+                --db-user $''${DB_USER}
+                --default-user admin
+                --language en
+              '';
+            };
+            secrets = [
+              "FRESHRSS_INSTALL,type=env"
+              "FRESHRSS_USER,type=env"
+            ];
+            healthCmd = "cli/health.php";
+            healthTimeout = "10s";
+            healthStartPeriod = "60s";
+            healthStartupInterval = "11s";
+            healthInterval = "75s";
+            healthRetries = 3;
+            networks = [networks."${serviceContainer}".ref];
+          };
+          unitConfig.Requires = [ containers."${serviceContainer}-db".ref ];
+          unitConfig.After = [ containers."${serviceContainer}-db".ref ];
+        };
+      };
+
+      networks."${serviceContainer}" = {};
+
+      autoUpdate.enable = true;
+    };
+  };
+}