From 1c0fa7606b156d3477b0d8efd50295c257bd56e3 Mon Sep 17 00:00:00 2001
From: Jakob Lechner <mail@jalr.de>
Date: Tue, 15 Apr 2025 12:25:43 +0200
Subject: [PATCH] Add mealie

---
 hosts/iron/secrets/mail-users.nix    | Bin 1524 -> 1705 bytes
 hosts/magnesium/persistence.nix      |   1 +
 hosts/magnesium/ports.nix            |   1 +
 hosts/magnesium/secrets.yaml         |   7 ++---
 hosts/magnesium/services/default.nix |   1 +
 hosts/magnesium/services/mealie.nix  |  37 +++++++++++++++++++++++++++
 6 files changed, 44 insertions(+), 3 deletions(-)
 create mode 100644 hosts/magnesium/services/mealie.nix

diff --git a/hosts/iron/secrets/mail-users.nix b/hosts/iron/secrets/mail-users.nix
index 0046b885874d45c973507b8b794424d0d4864c26..bc181b7a1cfffa4a934f24a68ae8e386c7ac7ff5 100644
GIT binary patch
literal 1705
zcmZQ@_Y83kiVO&0(EB;{L%-<?yRVF^tbfKQZQOoiuF%BFufLx<)hC^B>dSeV7$7Ly
z?6hC%(Wcl5!OycwZL_Uk%AIt4>Mig@#OqA+=CIpYIhti<cI*H5cWA|)tSOy$_s44$
zuFv5dIa&>ilI4F2Pg7+{nZAf4{`(7+AOYUXXSXdZW4q?}ZGlBY(gt3QawXRri*=4!
z|5Co?c=xos2VWAiZ5-putm~cz-zO(#_QZc~{6F!^mC11zq6FSV-oN2`E=KRdDU)M8
zj~4gO@OiCk$5?56>%irZIHjC7CxgSbvYu-4eCwok-Zj^E-P89>#%cV=yVf%%Hpc3*
zuNFTZl$gpC{L(5?O0n+9)NMf@GKJSz<*aMGIODsnvD^GrHR0y_9Zz0k-dlF&*w$mS
zO^<yS=XzMOo9WnA_Er5`7MiaxQtp+Lw|Ox^X<z80WfF<+@-JR>`*++mvhC)!<-%)D
zoo$%1Sj>9L;dvRwn|TH8jdnEp|KkY0aXaPD&W}0*AN}|BCYj$2%QlHwvG&#Ff4aSX
zdef7Hl-%e2yjK)hp*e5<q3&Df>g%#y0-F_rmoQ&vnZ7S^2mj>lU1^$~FAhbA?<$&k
zRzd81T(w?&|Fdf5JPEz!%*K<}s?Buz#FUh0mw2yk|6caYgnNcRCw=ztH!I+Oy8rO$
zK9juI6J`g0u^hX!ZsNK{EctHn=Pu0Mq*{1q%cB&*$LB7d-@7d|ao6%$lOmUy31)2h
z-Scebi=W$eCKe^@_lRXHSA`Z`_vd{RA8YweVUomlzsnobC-4;4hi!PIx#Q97-S3yJ
zRBdoP`taSe&ZoI@XD3-4dKjU3sy|>yUz?>~(w3<*mxHeT2n>=9wa|D}HzEIlt>~(w
zHoI~bq&)9AzWf+}^PI>HdyOr&zn)?ub1~}nrY~mmo@RvHu9+3$$Li9%<JO%&GXnQL
zwR~PT%lp@fSnt`VnHg-hl`U0V8Pg@YVNLCu2}?G030SZ3JtHrCd-}#tv$J%X*>&F4
zY3;IF{3-K}>I{M15B|sNBu<o!sgu3GZ^^qSyf^biD?7I>w9dK0XuLL2hi^*iyrjSP
zA5Hr>-%s>tipAq&?4p0KO)76vRWH@J`pNy$HJ@bJn+rMml+!n8-<pvkr{lQqQpi!K
zkCS?mr^)B}^+g@`3;(M6X37;2`Gs++(hTBdERi#gD93XAeeYRtZuZY}E)_{^Tl;Ee
zHqM!y)*!ZgyN1m27jI0uuPrl=5=}pO|4O>7f$L1glP={~c(>Gc+AD|iJ?;}p<l$s^
z;~adj{K?<@e@{%efB!0B1xwK5|97X%Ju20}df=#Z>5I$XUc9KaGR;=p{6W*FXI`&j
z$i=s_{TzQN=CZ!e`g$xXVLF?sbhz4*UsH;vzWN@1PP-viDmV9)=IZdx2Q;mg{dpSg
z!d+5)=~2KU?@r-+D;no9G|$Zb75*rbd)m$A%WKnCeO|mpYun|bq~-DZ6fP^p1{ZJm
zFO^w8FYm*XLxF||_MDI@z2nuxrq;@qUHayD%H70@C;e`BcSyUHHsr2%`~GQ7+Yy<-
zY29ZwhUbP%`|+lGUwPd}|KloeRCg^_o7a}V-}&$t;iLUeq+)Nad&88*8uoVm7E4(>
z;~d%bXWU-=;9t|LHQ{%^UU1*+ynV;2GQHlqZVvhs^Ec+6OZ>F=t{2Qw5_;UYCu}zR
zkb2<qz7_uppS;+__d07%hrE!%rw41ToX)Jhtd{xfrMJ`9r%^tCpZ%!b^utZMkmtq8
zQ>TA3xEfdNIpxe*H$iTDbz8_vraP%iRdf$O6I#Rk;;^JAqt5Z|Un}mdUnSzy`+QDD
zsX^gXHP_6*$nwf<&pxv`vcKQ+`_isbd$s>RFR<2JInwjHZ)L`$j}v=!Hp)C)=e?6<
z{?ff01Qy?%H|PBU{|+<tC8_OszNUe-g)(293|ytJY2Eoag?n$;#M>2uSvDURR`T6n
zGF!a7EB)*iMT?56lLoRnCl;0He6;YhztW+kc+Db7gGo>!uDn|8kIu=-O9L_w2H!N$
zZhCU*-5WcH3yBT}%uEK`CKk;!XSK4Bn>u50<WA<g#6z9gik7z>UV7)4#r)qCzQnZg
zj@Vzj6Gu01)yt4m$x=GOx2y1h*zLx)Ck<0P1KJkG*xa^XmRNE3*{e^_r`_AM{lM>4
zZw}nbDY30ndwM%)S-$WYpIZfwx6gRj+28nS@{CMH6J_Vd`;3d2V+_vk-7+Wq<O02Q
zrKvYQFW#QW`=PFMqQ|8&b8oo>UKz#ME!$ts4{xuje&;BCY1L2mzYzwJ-s{3I7&1(J
m-2O^BrYTFl>3GerPrM)GHOgzA-8~w-UooX8>G|{j7P<g{w_UXW

literal 1524
zcmZQ@_Y83kiVO&05aO?RHS60mha(MQ3{4+T=?i|@zlCi^Pg7RM2ib)dlm6&S?Anst
zC%e+CtYMOOcG-i#gwIX2{J%<XIrru4+`RJVlIto{e;u%08~ggV-_3+?PZifWT|b<6
z?fQ$fYT-kAEh}#IBwzSvuH}69{>8lCH3b3_zG?*)zrLy#`|)S(kF&FX__-Vwo;quD
z`h?BvV}I^De(6S0$?jU|oi}Ej_Sw6sZ3TzfMW;EpDy&%@kIw2c`_9&N=61Pk#60K8
z-}&roN~)KZ^vz6m?J|)sa(|a`HRaNbf3MtF>yAI@o)`Q7;`b!8f6ZrumHZY=_h<Oq
z$LXs0e23g_=Q4-dLy2$ybQe$L<PEs0X`Z}t^PWS?_Qh@s<Nd|BV5VL1hL49-pGUo1
zV{OFA!tD8GW!JmeHzYiR1iUUEoqc?(_||IKNp~W@?<wHdofok8!l8v?OVZ!D-V{hL
zEijdSWo@<YR{qgVZb~tS3svsAHP;8F{r}#vXxdSo^G`Q*%e3CzCy@8?;yz0Oo~~8h
zlHo@tuPE*`UHVG-{o;A;Sq-0dwq0eYn|}RyB3D}dY1Y78g@r<uclPXF-STSk2hNZk
zhHEFCNU6A!xpwo}NelWWH%AvXd}t|HTX^bgLTi=drVFPX>>O{(Olw-N7jfZ2%7IU_
z+ONB8te7ja<JXt+><71wPt&Y5=ab28YuQ;*ex;4!o7<%u!80-?Z|^r<^|tEBr1|<g
zAJ?vF3R&f9wRB?gM&38armUR&`Ymrv)<NG_j2F#PANlQ;zY{;DoBwCcvbI&i#}W=r
z+TrY$^mk=_K<2|E%(<+)DsM#oXx;KSY+4JC+EdvITV{24|FXZ19RFQ;)B^8%zTYVD
z)oh{)n?&e&HtoEOOK)Y`Q#;NI@1OE*+M||&)M$rYcN?32+XX9nZ;ec7Qa}08Z+E1T
z)r$ih9Xp#_-doJ%y!mPA)ALWo7d|_8s_=jN5u2%#vsa6Ci+Nl%P<0eo@>}=FwRt8|
zelj~^n4=^*L#lsdW$4FDJuiFxV$Hp{tXI4lrZ2ON{+~`c{n6xtlCRg#Wi3ZS55>D_
z{NB|$F);OOSct^xzcp!>KF|DDo}Xa(A+6eX<?QPVLo%Cu<+xV+2^McVr=(G(u`K=7
z<tsrG?iyJ1OMbA~@aOQif@znxoX?bLezH=tse7|Zv&#`Z!Ng?^YaBaI-cZrplau4Y
zn8>g(>~pNk&ET2!KD7}izh1a)-6s9(c-x<y*Mlo29^N<WtG_GX8G)tRv;L{{zUUKO
zu<iSc_0DHp7m7wGFWqiu_2SZ_(q#)vj|Ml~?48A~z2>0Of$dHqSIee8wA$o<Q|Emk
zivqVhyY$f+#*z}b+dEI5VOx6rr8%pdOS|fgUsERY);w{2v|-(ykOTK+7q2R}KWN5!
zw#uqdta3`nfoeHX(e!<*y;aJu?*DxB!lkV>=l3`_P1z_qe{;3WJK>!M)9;9D$XuT%
zb@i|E)(6WRr53#Mcp}e~y^(KO&NkKP2*wW|@<Vtw7k8<potm_F^F}A0y%QHTa`*1e
zD3>$g|JeRM{>qPA+E0I7(bjH0S)ZAEJ!`?1l#~nEXP4dPx!uwI(nUi(v?cGu^u=#t
z7nfa#<gb_JUiUxs=t^bHvYDEflp205nG?4;&{pN#A~pLbPgJ>LB92Xc_oJci(f*r~
z){|x`X!1T^+jT+d`>gy@`!h>zEUy0(<de`pw#GVYPWSvZhW~$jcbKea@Zn_7f>Teg
zteOA4=E2rAb{`La++I6{d0wYTish+WFGG?#H*j12{#J0{x17}b{YyFC<lR5FviynJ
zMT-~uc28q!s?zoRKf35odLZFwoF!6jRw1;cuHxIYhb6pOGx#2E>v{O3+Unrl34NA5
zm!2(Xlufnt(4H`9ev;JGn`}4bB272NO`C8pwzYhwoUU@qqQwi<x2DU#blUcyZ^EZ5
zYXt?f<W1TRUgd7S7L;+ia&uwywsRdnMT3{hN=2PKHreIv$|rxXy((L^%zb@PUtiR=
zHT#Wco$+qf{l4p=*VLEk&W{dmaq@DF6cpHElA_9D(f?4c?+5!lmhPxh=~XYiLQ7A?
HA9w-)FwqoG

diff --git a/hosts/magnesium/persistence.nix b/hosts/magnesium/persistence.nix
index ed97650..5dbd5fc 100644
--- a/hosts/magnesium/persistence.nix
+++ b/hosts/magnesium/persistence.nix
@@ -32,6 +32,7 @@
       "/var/lib/acme"
       "/var/lib/hedgedoc"
       "/var/lib/nixos"
+      "/var/lib/private/mealie"
       "/var/lib/private/ntfy-sh"
       {
         directory = "/var/lib/trilium";
diff --git a/hosts/magnesium/ports.nix b/hosts/magnesium/ports.nix
index 52d3ddf..ee689c4 100644
--- a/hosts/magnesium/ports.nix
+++ b/hosts/magnesium/ports.nix
@@ -8,6 +8,7 @@
     coturn-tls = { tcp = [ 5349 5350 ]; udp = [ 5349 5350 ]; };
     forgejo-ssh.tcp = 2022;
     hedgedoc.tcp = 3000;
+    mealie.tcp = 9000;
     nginx-http.tcp = 80;
     nginx-https.tcp = 443;
     ntfy.tcp = 12474;
diff --git a/hosts/magnesium/secrets.yaml b/hosts/magnesium/secrets.yaml
index 317d48e..1187ccd 100644
--- a/hosts/magnesium/secrets.yaml
+++ b/hosts/magnesium/secrets.yaml
@@ -3,6 +3,7 @@ turn-static-auth-secret: ENC[AES256_GCM,data:rzhixUemFPwKj1BcVPZd7KtUO9OA6A2R4qE
 gitlab-runner_fablab-nea-hcloud-labsync: ENC[AES256_GCM,data:+znVO8cQxjDdhch7oUALZvt84iJmWnAx6lTM0+WGkGtaRWTCTPjgnst5waSJpw/Oysrd1PkXZKmLHyHuU7K/CHQij7sWH50G3ZcUum58klJc3dCPztlrLpDVHeSwyYiLpsqkQTfjqLPfrMkxuxBgTEVXlq2ZnFuyOGbFx9hubPxLeyQKakiW3qZWGjbFXYAps7Gl61AVdKJj3y1otX2JbCjG9x2i6FHZpl5ywwQCjKNM,iv:7v+I/oJtWDap6PNIJ4Qm3Si9dGs7a79SaMhnr/tbe1A=,tag:7jgoLtdWAEKMkWoXZ10owA==,type:str]
 forgejo-mail: ENC[AES256_GCM,data:eZv9dM0a06wFJaDUZjo=,iv:L32ab5k/AX8HqSACJA5w+WbzLlBijA5++Gcr2SrnYIU=,tag:ddyTXikWTMnxq86IijgyYg==,type:str]
 hedgedoc-session-secret: ENC[AES256_GCM,data:AYUiUF7R+5C3F5kNRL0R95e1l3Y59tIP388uY0IYCskBhR0H0XMVvyrX/gIM33Twwkc5it+fQtNPNXsbrAnoKQ==,iv:Q6pDEdFplp845/DCHutwni/g7Ch39pTCvfNs4Eh28CQ=,tag:aqVGs3iThmepT7iJusLOMA==,type:str]
+mealie: ENC[AES256_GCM,data:4LlxJjDstTPZCD7Xyb+0CRkeDafP9a9oMuYDnXznINe+LrfkJGKwQIwP0B3VpeMmZ0Rwe7Tvje0ZWySFGADireb2r7TjDyASAoXJDyNNJ8byRc5Zt77zL2dp/W4xVt8WpQvwsXosjDv3NN6we831wWUrfNtp0g34YLqSU3F/9i7AaU7nVKnQ9QtJRVg5O57nhs/ZXopKOBUdiKAmxcl0hNNdQdaQX6xkDCWrV4432IOckqyqEQyd9KeCURuWeTUgPmTmnt9Cj8KkaQ39fd0LAGRjOBsKo4C4,iv:o5BPW4Wcg4KcFkJHc/mdrO4Rh+1nifxulYkF+iM3LEw=,tag:KXwDr3VHxjeHkyo23SPJgA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -18,8 +19,8 @@ sops:
             elNwdVlJS2NCWUlXcEZvZWsvZ29FRnMK/qa6Qj1yQc91PWk9tMKSyFkMfYcHIKpQ
             jcPmGWbpi2NPL/F0Xz2X/zQQxWzs9uzlS1VH+y8JRe1EPMYJ78NXZw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-11T15:28:59Z"
-    mac: ENC[AES256_GCM,data:1RnyUrbEI2JKpicmA3QV+5ob+vByahMjc4+ZpLbcMyZv/KXn02VP+OQaLm9NgPfpZmSmRgbdPNQAP4f71z/EjcceyANAhnvql3zuYgSXNp5l/IYo5UFZdWgQa14XTGO518969CDLW1zJnlkBtbtLEVlMJiQ/EraV1eNtgCr5UEU=,iv:0fLjboGiejUI9LxHW80ed+/Lf+jlN5UH7tVqfBptq0w=,tag:4Tyrqy9XwQAm0etooVBNZg==,type:str]
+    lastmodified: "2025-04-14T23:06:22Z"
+    mac: ENC[AES256_GCM,data:FSJSzA9xGKH9FBMWHPJwgbltkeRoumgpeFeftsgUWrMcc2O+sldNa/Gl1Pnmz5AwXNT5zRGv/zcnrt3lQMY+1vPrg3+DRrv5fn2OtHIZxN0cz+okqEoE40w7WLUZSyj9IESjlJKOL/nOdXf7EkXL64ZWDAZ6YKYe7JwD5oCGMOM=,iv:xKFdHYTqLCWtJFWIiZjtzJZpG1RZWPdeE1i6PQqYNsk=,tag:DfzN2iDjavGA/uEjLKZotw==,type:str]
     pgp:
         - created_at: "2025-04-08T22:53:53Z"
           enc: |-
@@ -33,4 +34,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 3044E71E3DEFF49B586CF5809BF4FCCB90854DA9
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.9.4
diff --git a/hosts/magnesium/services/default.nix b/hosts/magnesium/services/default.nix
index b4fdf50..813f30c 100644
--- a/hosts/magnesium/services/default.nix
+++ b/hosts/magnesium/services/default.nix
@@ -4,6 +4,7 @@
     ./forgejo.nix
     ./gitlab-runner.nix
     ./hedgedoc.nix
+    ./mealie.nix
     ./ntfy.nix
     ./public-ip-tunnel.nix
     ./trilium.nix
diff --git a/hosts/magnesium/services/mealie.nix b/hosts/magnesium/services/mealie.nix
new file mode 100644
index 0000000..5448534
--- /dev/null
+++ b/hosts/magnesium/services/mealie.nix
@@ -0,0 +1,37 @@
+{ config, ... }:
+
+let
+  domain = "mealie.jalr.de";
+  cfg = config.services.mealie;
+in
+{
+  sops.secrets.mealie = {
+    sopsFile = ../secrets.yaml;
+  };
+
+  services.mealie = {
+    enable = true;
+    credentialsFile = config.sops.secrets.mealie.path;
+    port = config.networking.ports.mealie.tcp;
+    listenAddress = "127.0.0.1";
+    settings = {
+      BASE_URL = "https://${domain}";
+      ALLOW_SIGNUP = "false";
+      SMTP_HOST = "hha.jalr.de";
+      SMTP_PORT = 465;
+      SMTP_FROM_NAME = "mealie";
+      SMTP_AUTH_STRATEGY = "TLS";
+      SMTP_FROM_EMAIL = "no-reply@jalr.de";
+      SMTP_USER = "mealie@jalr.de";
+    };
+  };
+
+  services.nginx.virtualHosts."${domain}" = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString cfg.port}";
+    };
+  };
+}