From e4a8a48b41f10f26d0aadbcb45c557a94386890b Mon Sep 17 00:00:00 2001
From: Hadi <112569860+anotherhadi@users.noreply.github.com>
Date: Sun, 20 Sep 2026 12:34:40 +0200
Subject: [PATCH] init miniflux

Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>
---
 hosts/server/configuration.nix    |  1 +
 hosts/server/secrets/secrets.yaml |  5 ++--
 server-modules/miniflux.nix       | 43 +++++++++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 server-modules/miniflux.nix

diff --git a/hosts/server/configuration.nix b/hosts/server/configuration.nix
index f987a3b8..e5ef7f83 100644
--- a/hosts/server/configuration.nix
+++ b/hosts/server/configuration.nix
@@ -24,6 +24,7 @@
     ../../server-modules/gitea.nix
     ../../server-modules/signal-cli-rest-api.nix
     ../../server-modules/home-assistant
+    ../../server-modules/miniflux.nix
 
     # You should let those lines as is
     ./hardware-configuration.nix
diff --git a/hosts/server/secrets/secrets.yaml b/hosts/server/secrets/secrets.yaml
index d9a24f12..542fc5ef 100644
--- a/hosts/server/secrets/secrets.yaml
+++ b/hosts/server/secrets/secrets.yaml
@@ -13,6 +13,7 @@ signal_sender_number: ENC[AES256_GCM,data:7eR112vBWgfsY5kX,iv:omEgSZflp/vk28Pylb
 h: ENC[AES256_GCM,data:roBRoH3sAPznAA==,iv:MRZRgKbEEjZosjRH35nYXg04WDXTGUizdVXyhcjQRB8=,tag:ishmf5EXF7UQFE0YoHNPjA==,type:str]
 d: ENC[AES256_GCM,data:1XFzLM+rTmJukg==,iv:/tJ+1x7tdmY2+U+l4UPWaj4X49tanLVv/Re3OoEdClc=,tag:99GQ/1PukfQODPJgTlFWdw==,type:str]
 alarm_code: ENC[AES256_GCM,data:+zZrmbYJ,iv:9Mcf/y/1ccVPFzdTAZO98gPvMaGzGybyMgai4QFFq7A=,tag:a20nFKr+APSgTKNY9ZL50w==,type:str]
+miniflux-admin-credentials: ENC[AES256_GCM,data:Qedg61v7Oe/XZ04Qi7tTYOZPIge+EnYB2rPMSNIT2cOX+uRtqJyRXR2UK3D0a1o=,iv:y1l+0Y3SIn0Mdr9hyq3YuVaixBTNuqBSUyh1mJmBG1s=,tag:KdeNUYT6n+puukBkFMTFxw==,type:str]
 sops:
     age:
         - enc: |
@@ -24,7 +25,7 @@ sops:
             yefODJGVtHrOm3yeXC2xlTi3sFW+c5wUl2yPqddbvcBt5Ud/yd4iXQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age12yvtj49pfh3fqzqflscm0ek4yzrjhr6cqhn7x89gdxnlykq0xudq5c7334
-    lastmodified: "2026-09-11T17:46:11Z"
-    mac: ENC[AES256_GCM,data:mmIEQQz2r9Ync+uMtqVUJYew+Vz7QMx5iT/eSjG1T6et9pEB97v4+twqZAYvYZIrQzFP6yvGyONRHZObNNfz3FH/emUPZ5hEiw0TNvG9Lkw2BRGEcv4ojUdNrxGkX1W49d22De3uR+fTdUQikORuD/ma5Fu+fg0Xpho4cFsqDjc=,iv:ZsHEwa3TVP+wOQsMAbZIy3yaOsFPp2vwzeF7XtpEMBE=,tag:GsCgV6iNwLYpK4aZ3NLRaw==,type:str]
+    lastmodified: "2026-09-20T10:33:49Z"
+    mac: ENC[AES256_GCM,data:VM/PJpCNmQUdhEZMT0jeS1R84yybWdRTigApj8QsnsBSPORl6QHxX5MOdokgCrmVCBTttDQN3XR7Wys/aFHkO4ejqJcZE63IcY/GBPQ9EBCboyCqGejowGL/OYa6BVeT8a/7jy7CjlBjc8URoydBHP67aQAh2gc/v29yDlNOM3A=,iv:s7Sao51ZL6BK0qnit46jAywe+g3sjMTF2I5PROPfP7E=,tag:62oHPfWDYEVok+KnrOxVUg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3
diff --git a/server-modules/miniflux.nix b/server-modules/miniflux.nix
new file mode 100644
index 00000000..aacd5a95
--- /dev/null
+++ b/server-modules/miniflux.nix
@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (import ./mk-container.nix {inherit lib config;}) mkContainer;
+  domain = config.var.domain;
+in {
+  imports = [
+    (mkContainer {
+      name = "miniflux";
+      hostIp = "10.233.8.1";
+      containerIp = "10.233.8.2";
+      internet = true;
+      bindMounts = {
+        "/run/secrets/miniflux-admin-credentials" = {
+          hostPath = config.sops.secrets.miniflux-admin-credentials.path;
+          isReadOnly = true;
+        };
+      };
+      nixosConfig = {...}: {
+        services.miniflux = {
+          enable = true;
+          createDatabaseLocally = true;
+          config = {
+            LISTEN_ADDR = "0.0.0.0:8080";
+            BASE_URL = "https://miniflux.${domain}";
+          };
+          adminCredentialsFile = "/run/secrets/miniflux-admin-credentials";
+        };
+        networking.firewall.allowedTCPPorts = [8080];
+        system.stateVersion = "24.05";
+      };
+    })
+  ];
+
+  sops.secrets.miniflux-admin-credentials = {
+    owner = "root";
+    mode = "0400";
+  };
+
+  services.cloudflared.tunnels."${config.var.tunnelId}".ingress."miniflux.${domain}" = "http://10.233.8.2:8080";
+}