miniflux: use TCP on localhost instead of Unix socket

- Add miniflux service listening on Unix socket at /run/miniflux/miniflux.sock
- Remove FreshRSS configuration and data directory
- Update nginx to reverse proxy to miniflux socket
- Update secrets to use miniflux-admincreds.age

aspects/hosts/_alexandria/freshrss.nix

@@ -1,34 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  ...
-}:
-
-let
-  mkNginxVHosts = inputs.self.lib.mkNginxVHosts;
-in
-
-{
-  services = {
-    freshrss = {
-      enable = true;
-      defaultUser = "admin";
-      passwordFile = config.age.secrets.freshrss-adminpass.path;
-      baseUrl = "https://rss.baduhai.dev";
-      dataDir = "/data/freshrss";
-      webserver = "nginx";
-      virtualHost = "rss.baduhai.dev";
-    };
-
-    nginx.virtualHosts = mkNginxVHosts {
-      domains."rss.baduhai.dev" = { };
-    };
-  };
-
-  age.secrets.freshrss-adminpass = {
-    file = "${inputs.self}/secrets/freshrss-adminpass.age";
-    owner = "freshrss";
-    group = "freshrss";
-  };
-}

aspects/hosts/_alexandria/miniflux.nix

@@ -0,0 +1,31 @@
+{ config, inputs, ... }:
+
+let
+  mkNginxVHosts = inputs.self.lib.mkNginxVHosts;
+in
+
+{
+  services = {
+    miniflux = {
+      enable = true;
+      config = {
+        LISTEN_ADDR = "localhost:8080";
+        CREATE_ADMIN = 1;
+      };
+      adminCredentialsFile = config.age.secrets.miniflux-admincreds.path;
+      createDatabaseLocally = true;
+    };
+
+    nginx.virtualHosts = mkNginxVHosts {
+      domains."rss.baduhai.dev" = {
+        locations."/".proxyPass = "http://${config.services.miniflux.config.LISTEN_ADDR}/";
+      };
+    };
+  };
+
+  age.secrets.miniflux-admincreds = {
+    file = "${inputs.self}/secrets/miniflux-admincreds.age";
+    owner = "miniflux";
+    group = "miniflux";
+  };
+}

data/services.nix

@@ -34,7 +34,7 @@
       host = "alexandria";
     }
     {
-      name = "freshrss";
+      name = "miniflux";
       domain = "rss.baduhai.dev";
       host = "alexandria";
     }

secrets/miniflux-admincreds.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 Kfdnog QEq4A011oVny6vo1+wOcQNnpkf77216PZXJqK4rGTGY
+FPeASmXRirxeF2T2jXhA/tEaO0p1CZJ6D3lv3p2KTX0
+-> ssh-ed25519 8YSAiw gxuXAt2nG6qXhWwAAiFwNCNYJV2VGKnDNkjU61NOJ2o
+xncp+M4lVixiTmXQU5QrtdQ860t/1JpvOcO4YXAy3to
+-> ssh-ed25519 J6tVTA Mr0XrEFP/o7nFWBKal+ehzMiejWpVDIBiiMqWzdOzEM
+0DTqm2LyMMlVZlTk67Y3hTiVjcJG9gprnXj6QjYxrJw
+--- FXUNp6O7vuibJj0RI3SZN3IBK1Hx5ouUij2ah05lCYA
+ÔX*÷“µ¬0¬²øÇBŒ<42>3Îð«jbœÍ<C593>S§Vÿ΀Äb¹BcÈi—øD.ïÇ5\é`&`越-Ui"gХȊ`OÒ µG<C2B5>cõ¥øÊæ'»Î=îºø«@qn[

secrets/secrets.nix

@@ -32,7 +32,7 @@ in
     rotterdam-user
     trantor
   ];
-  "freshrss-adminpass.age".publicKeys = [
+  "miniflux-admincreds.age".publicKeys = [
     io-user
     rotterdam-user
     alexandria