add freshrss on genepi

hosts/genepi/default.nix

@@ -13,6 +13,7 @@
     ./boot.nix
     ./disk.nix
     ./dns.nix
+    ./freshrss.nix
     ./hardware.nix
     ./immich.nix
     ./monitoring.nix

hosts/genepi/dns.nix

@@ -1,4 +1,15 @@
-{ config, ... }:
+{ config, lib, ... }:
+let
+  domain = "home.rpqt.fr";
+  genepi = {
+    ip = "100.83.123.79";
+    subdomains = [
+      "grafana"
+      "images"
+      "rss"
+    ];
+  };
+in
 {
   networking.firewall.interfaces."${config.services.tailscale.interfaceName}" = {
     allowedTCPPorts = [ 53 ];
@@ -14,14 +25,8 @@
         interface = [ "${config.services.tailscale.interfaceName}" ];
         access-control = [ "100.0.0.0/8 allow" ];
 
-        local-zone = [
-          ''"grafana.home.rpqt.fr." redirect''
-          ''"images.home.rpqt.fr" redirect''
-        ];
-        local-data = [
-          ''"grafana.home.rpqt.fr. IN A 100.83.123.79"''
-          ''"images.home.rpqt.fr. IN A 100.83.123.79"''
-        ];
+        local-zone = lib.map (subdomain: ''"${subdomain}.${domain}." redirect'') genepi.subdomains;
+        local-data = lib.map (subdomain: ''"${subdomain}.${domain}. IN A ${genepi.ip}"'') genepi.subdomains;
       };
     };
   };

hosts/genepi/freshrss.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+let
+  domain = "home.rpqt.fr";
+  subdomain = "rss.${domain}";
+in
+{
+  age.secrets.freshrss = {
+    file = ../../secrets/freshrss.age;
+    mode = "700";
+    owner = config.services.freshrss.user;
+  };
+
+  services.freshrss = {
+    enable = true;
+    baseUrl = "https://${subdomain}";
+    virtualHost = "${subdomain}";
+
+    defaultUser = "rpqt";
+    passwordFile = config.age.secrets.freshrss.path;
+  };
+
+  services.nginx.virtualHosts.${config.services.freshrss.virtualHost} = {
+    forceSSL = true;
+    useACMEHost = "${domain}";
+  };
+}