infra/config/services/freshrss.nix

{config, ...}: {
  services.freshrss = rec {
    enable = true;

    baseUrl = "https://${virtualHost}";
    virtualHost = "freshrss.winston.sh";

    defaultUser = "winston";
    passwordFile = config.age.secrets."services/freshrss/admin-credentials".path;
  };

  age.secrets."services/freshrss/admin-credentials".owner = "freshrss";

  services.nginx.virtualHosts."${config.services.freshrss.virtualHost}" = {
    forceSSL = true;
    enableACME = false;
    useACMEHost = "winston.sh";
    extraConfig =
      # nginx
      ''
        access_log /var/log/nginx/freshrss.access.log combined_geoip;
      '';
  };
}