{ config, lib, pkgs, evalConfig, ... }: { containers.pad-i4f = { privateNetwork = true; hostAddress = "192.168.100.1"; localAddress = "192.168.100.6"; autoStart = true; ephemeral = true; bindMounts = { "/persist" = { hostPath = "/persist/containers/pad-i4f"; isReadOnly = false; }; }; path = evalConfig ({ config, lib, ... }: { services.hedgedoc = { enable = true; settings = { allowAnonymous = true; allowFreeURL = true; allowGravatar = false; allowOrigin = [ "localhost" "pad.infra4future.de" "fff-muc.de" ]; db = { host = "/run/postgresql"; dialect = "postgres"; database = "hedgedoc"; }; defaultPermission = "freely"; domain = "pad.infra4future.de"; host = "0.0.0.0"; protocolUseSSL = true; hsts.preload = false; email = false; }; }; systemd.services.hedgedoc.environment = { "CMD_LOGLEVEL" = "warn"; }; services.postgresql = { enable = true; package = pkgs.postgresql_15; authentication = '' local all all trust host hedgedoc hedgedoc 127.0.0.1/32 trust ''; ensureDatabases = [ "hedgedoc" ]; ensureUsers = [{ name = "hedgedoc"; ensureDBOwnership = true; }]; }; services.postgresqlBackup = { enable = true; databases = [ "hedgedoc" ]; startAt = "*-*-* 23:45:00"; location = "/persist/backups/postgres"; }; hacc.bindToPersist = [ "/var/lib/hedgedoc" ]; }); }; services.nginx.virtualHosts."pad.infra4future.de" = { forceSSL = true; enableACME = true; locations."/" = { proxyPass = "http://${config.containers.pad-i4f.localAddress}:3000"; extraConfig = '' add_header Access-Control-Allow-Origin "*"; proxy_buffering off; ''; }; }; }