From eef6031a94894e942427a571afb8dfe758feb71d Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <hi@m7.rs>
Date: Tue, 1 Sep 2026 12:04:35 -0300
Subject: [PATCH] feat(alcyone/freshrss): add tailnet-only feed reader

Assisted-by: pi (openai-codex/gpt-5.6-sol)
---
 hosts/nixos/alcyone/secrets.yaml          |  7 ++--
 hosts/nixos/alcyone/services/default.nix  |  1 +
 hosts/nixos/alcyone/services/freshrss.nix | 45 +++++++++++++++++++++++
 3 files changed, 50 insertions(+), 3 deletions(-)
 create mode 100644 hosts/nixos/alcyone/services/freshrss.nix

diff --git a/hosts/nixos/alcyone/secrets.yaml b/hosts/nixos/alcyone/secrets.yaml
index a5f50fe9..573332e3 100644
--- a/hosts/nixos/alcyone/secrets.yaml
+++ b/hosts/nixos/alcyone/secrets.yaml
@@ -14,6 +14,7 @@ grafana-gabriel-password: ENC[AES256_GCM,data:yWG0nNFWT0Of,iv:bd8bc0H4GiSfYctZHB
 grafana-key: ENC[AES256_GCM,data:2CE02My5u+caBTixq1qC8k2dMHQ=,iv:qNH/wPJJw5EhAZ405B3F1Vl7lTbGToShKA80goY9QS0=,tag:VjYIKGXhPTTuxT6h376aVQ==,type:str]
 firefly-key: ENC[AES256_GCM,data:9OHBwJp1Ekrv43aaP5p4GWoHlx90DolEpJofbq60Rwk=,iv:rvw0eyN2o+q3Hm/6nsNqWomJkqwB9TBcozymH0crKGU=,tag:5ohSol3iUIe5YOIhJXkRRA==,type:str]
 firefly-pat: ENC[AES256_GCM,data:OiX1+mEBsfsxd859rVQFkq3Xpe5I837OevCRHlHaJwdbLWc1qqcRX/KeF5OeTl6Km0ez7FjueOKk2EDpw4P/c66M9pyo9p/jqy2OrJK2BXNjGHdv7XqHtcRb06v8IypiosLBNQh1HB58HpsYvz1lQCI4k69JHPyYflALGthSum9s3mSf3gN59Uvq/qWPK+q19yrFAc5g6ZmfuCFuWNHNjQG3Eqg0y44OsAV++fykQ5eNxlt76Rf5yYnWmGv+c6MW/Rsuyz1UYpDpVjseVJhn4HmgwFDps0mfTnC/P5JSNyNLqiANN7ct0OijzpdG0jvFboZUx0x0FkKmneGlCmrtMJH0hIGyJ3wvzQaphcXtwNq0G8c/tf0HsDzaynNhlhCKr6x62meZcRCKYpfJ2speX4v+FIga5rh5kQqvhuyf8P7G7EDto5V7ErJ14ljWY7XGZGx5SPs8xQCnjkYMB3P1wH8XkBTKYI4nL/tspS7SmhDKNu7MQd0F37/KrC5fJ05S8aT37wpAgfNFAFQRfzHUmBTId0xVCcDHQm/PlOMKRQMtrfzhygkbYy8H1aMI0dnKRv7gzj3GhCR0tizYbaBIKex84OG+gLupc3CjQTZdIYiq+iAV9eheBk7BtX5+rZ/5lw8ZJDONr+0skxJVa1g0tOm2zNjraMqUJeY3cKAmQn1hgEEDEpBu0sFF3EnKkQMOP0HTfaJR7RxIuIEiYcsezeHv5unQBssjXYBAhwkoWe95q8w1pjB+a9/kXRXIG5lWarZeeZBKPNDcE+TX1UKqg2ialwNznG1wApogbEbZaHT22C/elcYiNuZ3gHTwODlLQmuuY3VhXzjKOj3FBVupRaj525glioVp7/k6mQgDyQneUHSUYwUf3ec+1/st/lO5qd9elwo2G8Of8kMQH6k2BJS7MerNJaryUN2uVcDudODcovTzOKfXdn5sp0gyn+6D7F1PGi4lZ9YFvlHggFjEYRF4XC69nQQN7LjOE431U2p/mYEa3G0LMKnClfkEc7iOaaV27TtUx1ma/hTuOByRgprY2aM8M/UD6/SNMcWzpt0tVe7xPm3wySCD8Hc+TaCbUBtaGFXpnavCslpQwKJ0kI4FqP/l0OSuV7DWM8Uh3BMEOIR0WDg4Uab7KqjaI9NeqiRjVRMdPOyqFFTriMKvQWNQyDiCq+PEsXNIyDaeVCM3IqR8jpuXWZNCmCVOn/VWikCLX3+AVPrnH92wxvj27kTPusbXJLf8mYWxsNJvM9/9PXYv31vGZ+0LLcCu/uXubGq0zLle7emrSXud929Bmfbfn+o=,iv:XSVs4Vpp4HNQyFOe5+Nb7OwWqQQKExkS2GQm7jAASEI=,tag:aSPRyTX5kWO7o2uT+9zCSg==,type:str]
+freshrss-password: ENC[AES256_GCM,data:UU8p43co3zFq,iv:YQLeJd6FIEgpJeJ7ZuN459qPUtRLxbXk2KUTGVMtzFs=,tag:aJB3LVs4DaMdl/5GIL3ung==,type:str]
 sops:
     age:
         - enc: |
@@ -25,8 +26,8 @@ sops:
             kTr57muioVJPcP5ccxgZZgd9jmUxErw5zS1Ex/rtXwa/27nrxFNKeg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1uxvuygmvwpfjrd9d3ulg6ln8dgvaw4l2c90mw0tr72qg3n8vd9ns3dm000
-    lastmodified: "2026-08-17T12:54:57Z"
-    mac: ENC[AES256_GCM,data:RIpcJczd2RtYeDhV3KdGPy4qA3fUgS3rBSm83gY0lvc1lrbc+zT8BuTLevftx3+PcLeRCNN6tEtdttYgzjbFt+RHNWMv30TBakpDgZI2B/GYW7dOUmP8sc+up47PfFcQec9dFympZAStmnXivUTW/RWk+S6+t/WcF4ZKBoJ31JE=,iv:59IjVd9vkSWArVg1z3DKQCuRidzqPkL8PpQuIs+340A=,tag:wYcAtF8mOPD0pXGnawXZ3A==,type:str]
+    lastmodified: "2026-09-01T16:31:05Z"
+    mac: ENC[AES256_GCM,data:fS/fgK6bY44HMdkgeIY4KuaNmYxXsWEAVPcc8UQ62WntrOhjXUdTcnlIat5ZLlvmm2Y0lbsURo/BYUR/rVGsDQO1hT6MTEK+JW+5M1wGAhi6kfyPQ4QXv3M9E7gwd3MglWjl2BmL8Ehy9WUm2jxgpASUezmRj4zOgUE5WyjjHv4=,iv:Pq0d5L4b7PAyeH0jIi2UPaWXhAVIiCZGzzeqCyde3Cc=,tag:7CD0X9vE5epi5tRziusvbw==,type:str]
     pgp:
         - created_at: "2023-02-06T01:46:44Z"
           enc: |-
@@ -47,4 +48,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 7088C7421873E0DB97FF17C2245CAB70B4C225E9
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.3
diff --git a/hosts/nixos/alcyone/services/default.nix b/hosts/nixos/alcyone/services/default.nix
index 097c74d2..572ff5f6 100644
--- a/hosts/nixos/alcyone/services/default.nix
+++ b/hosts/nixos/alcyone/services/default.nix
@@ -12,6 +12,7 @@
     ./prometheus.nix
     ./radicale.nix
     ./firefly.nix
+    ./freshrss.nix
     ./lumis.nix
 
     # Disabled for now
diff --git a/hosts/nixos/alcyone/services/freshrss.nix b/hosts/nixos/alcyone/services/freshrss.nix
new file mode 100644
index 00000000..b89906c6
--- /dev/null
+++ b/hosts/nixos/alcyone/services/freshrss.nix
@@ -0,0 +1,45 @@
+{config, ...}: let
+  domain = "feed.m7.rs";
+  tailnetOnly = ''
+    allow 127.0.0.1;
+    allow ::1;
+    allow ${config.services.headscale.settings.prefixes.v4};
+    allow ${config.services.headscale.settings.prefixes.v6};
+    deny all;
+  '';
+in {
+  services = {
+    freshrss = {
+      enable = true;
+      baseUrl = "https://${domain}";
+      defaultUser = "gabriel";
+      passwordFile = config.sops.secrets.freshrss-password.path;
+      api.enable = true;
+      virtualHost = domain;
+    };
+
+    nginx.virtualHosts.${domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations = {
+        "/".extraConfig = tailnetOnly;
+        "~ ^.+?\\.php(/.*)?$".extraConfig = tailnetOnly;
+      };
+    };
+  };
+
+  sops.secrets.freshrss-password = {
+    sopsFile = ../secrets.yaml;
+    owner = config.services.freshrss.user;
+    group = config.users.users.${config.services.freshrss.user}.group;
+  };
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = config.services.freshrss.dataDir;
+      user = config.services.freshrss.user;
+      group = config.users.users.${config.services.freshrss.user}.group;
+      mode = "0750";
+    }
+  ];
+}