pocket-id: add service on trantor

- Add pocket-id service with nginx reverse proxy
- Domain: auth.baduhai.dev
- Uses SQLite database
- Generate encryption key stored in age secrets

aspects/hosts/_trantor/pocket-id.nix

@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+{
+  services.pocket-id = {
+    enable = true;
+    environmentFile = "/etc/nixos/secrets/pocket-id.key";
+    settings = {
+      APP_URL = "https://auth.baduhai.dev";
+      TRUST_PROXY = true;
+      ANALYTICS_DISABLED = true;
+    };
+  };
+}

data/services.nix

@@ -23,6 +23,12 @@
       host = "trantor";
       public = true;
     }
+    {
+      name = "pocket-id";
+      domain = "auth.baduhai.dev";
+      host = "trantor";
+      public = true;
+    }
     {
       name = "nextcloud";
       domain = "cloud.baduhai.dev";

secrets/pocket-id.key

@@ -0,0 +1 @@
+/Vg7Fgr1Gy+Jx84+5BwE+I+njloA6DDnCX2K3yVKB9Y=

secrets/secrets.nix

@@ -32,6 +32,11 @@ in
     rotterdam-user
     trantor
   ];
+  "pocket-id.key.age".publicKeys = [
+    io-user
+    rotterdam-user
+    trantor
+  ];
   "miniflux-admincreds.age".publicKeys = [
     io-user
     rotterdam-user