alexandria: replace FreshRSS with Miniflux

- Add miniflux service listening on Unix socket at /run/miniflux/miniflux.sock
- Remove FreshRSS configuration and data directory
- Update nginx to reverse proxy to miniflux socket
- Update secrets to use miniflux-admincreds.age

aspects/hosts/_alexandria/freshrss.nix

@@ -1,34 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  ...
-}:
-
-let
-  mkNginxVHosts = inputs.self.lib.mkNginxVHosts;
-in
-
-{
-  services = {
-    freshrss = {
-      enable = true;
-      defaultUser = "admin";
-      passwordFile = config.age.secrets.freshrss-adminpass.path;
-      baseUrl = "https://rss.baduhai.dev";
-      dataDir = "/data/freshrss";
-      webserver = "nginx";
-      virtualHost = "rss.baduhai.dev";
-    };
-
-    nginx.virtualHosts = mkNginxVHosts {
-      domains."rss.baduhai.dev" = { };
-    };
-  };
-
-  age.secrets.freshrss-adminpass = {
-    file = "${inputs.self}/secrets/freshrss-adminpass.age";
-    owner = "freshrss";
-    group = "freshrss";
-  };
-}

aspects/hosts/_alexandria/miniflux.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  inputs,
+  ...
+}:
+
+let
+  mkNginxVHosts = inputs.self.lib.mkNginxVHosts;
+in
+
+{
+  services = {
+    miniflux = {
+      enable = true;
+      config = {
+        LISTEN_ADDR = "/run/miniflux/miniflux.sock";
+        CREATE_ADMIN = 1;
+      };
+      adminCredentialsFile = config.age.secrets.miniflux-admincreds.path;
+      createDatabaseLocally = true;
+    };
+
+    nginx.virtualHosts = mkNginxVHosts {
+      domains."rss.baduhai.dev" = {
+        locations."/".proxyPass = "http://unix:/run/miniflux/miniflux.sock:/";
+      };
+    };
+  };
+
+  users.users.nginx.extraGroups = [ "miniflux" ];
+
+  age.secrets.miniflux-admincreds = {
+    file = "${inputs.self}/secrets/miniflux-admincreds.age";
+    owner = "miniflux";
+    group = "miniflux";
+  };
+}