nas: add mealie

Makefile

@@ -21,6 +21,10 @@ switch-override: add
 deploy: add
 	nixos-rebuild switch --flake .#nas --target-host nas --use-remote-sudo
 
+.PHONY: deploy-override
+deploy-override: add
+	nixos-rebuild switch --flake .#nas --override-input nix-secrets ../nix-secrets --target-host nas --use-remote-sudo
+
 .PHONY: dry-build-nas
 dry-build-nas: add
 	NIXPKGS_ALLOW_INSECURE=1 nixos-rebuild dry-build --flake .#nas --impure

hosts/nas/authelia.nix

@@ -139,6 +139,15 @@ in
               ];
               consent_mode = "implicit";
             }
+            {
+              client_id = "mealie";
+              client_secret = secrets.authelia-clients-mealie;
+              authorization_policy = "one_factor";
+              redirect_uris = [
+                "https://mealie.${domain}/login"
+              ];
+              consent_mode = "implicit";
+            }
           ];
         };
       };

hosts/nas/configuration.nix

@@ -26,6 +26,7 @@ in
     ./scrutiny.nix
     ./open-webui.nix
     ./homeassistant.nix
+    ./mealie.nix
   ];
 
   homelab.domain = lib.mkDefault secrets.prod-domain;

hosts/nas/mealie.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  pkgs,
+  lib,
+  secrets,
+  ...
+}:
+{
+  services.mealie = {
+    enable = true;
+    settings = {
+      OIDC_AUTH_ENABLED = "true";
+      OIDC_SIGNUP_ENABLED = "true";
+      OIDC_CONFIGURATION_URL = "https://auth.${config.homelab.domain}/.well-known/openid-configuration";
+      OIDC_CLIENT_ID = "mealie";
+      OIDC_AUTO_REDIRECT = "true"; # WARNING: a default local admin user is created by default!
+    };
+    credentialsFile = config.age.secrets.mealie-credentials.path;
+  };
+  services.nginx.virtualHosts."mealie.${config.homelab.domain}" = {
+    forceSSL = true;
+    useACMEHost = config.homelab.domain;
+    locations."/" = {
+      proxyPass = "http://localhost:${toString config.services.mealie.port}";
+      proxyWebsockets = true;
+      recommendedProxySettings = true;
+    };
+  };
+
+  homelab.dashboard.Services.Mealie.href = "https://mealie.${config.homelab.domain}";
+}