feat: add anki

hosts/APPA/services/adguard-home.nix

@@ -38,6 +38,10 @@
             domain = config.services.gitea.domain;
             answer = "192.168.2.40";
           }
+          {
+            domain = "anki.dryb.org";
+            answer = "192.168.2.40";
+          }
         ];
       };
       dhcp = {

hosts/APPA/services/anki.nix

@@ -0,0 +1,59 @@
+{ config, pkgs, ... }:
+let
+  stateDir = "/var/lib/anki";
+  user = "anki";
+  group = "anki";
+  host = "127.0.0.1";
+  port = 8004;
+
+  anki-sync-server-run = pkgs.writeShellScriptBin "anki-sync-server-run" ''
+    export SYNC_USER1=admin:"$(cat "$1")"
+    exec ${pkgs.anki-sync-server}/bin/anki-sync-server
+  '';
+in
+{
+
+  users.users = {
+    "${user}" = {
+      description = "Anki Sync Server";
+      home = stateDir;
+      createHome = true;
+      useDefaultShell = true;
+      group = group;
+      isSystemUser = true;
+    };
+  };
+
+  users.groups = {
+    "${group}" = { };
+  };
+
+  age.secrets.passwords-anki-admin = {
+    file = ../../../secrets/passwords/anki/admin.age;
+    mode = "640";
+    owner = user;
+    group = group;
+  };
+
+  systemd.services.anki-sync-server = {
+    description = "anki-sync-server: Anki sync server built into Anki";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    environment = {
+      SYNC_BASE = stateDir;
+      SYNC_HOST = host;
+      SYNC_PORT = toString port;
+    };
+
+    serviceConfig = {
+      Type = "simple";
+      User = user;
+      Group = group;
+      ExecStart = "${anki-sync-server-run}/bin/anki-sync-server-run ${config.age.secrets.passwords-anki-admin.path}";
+      Restart = "always";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ port ];
+
+}

hosts/APPA/services/default.nix

@@ -1,6 +1,7 @@
 {
   imports = [
     ./adguard-home.nix
+    ./anki.nix
     ./gitea.nix
     ./homepage-dashboard.nix
     ./nginx.nix

hosts/APPA/services/nginx.nix

@@ -17,6 +17,11 @@
         proxyPass = "http://127.0.0.1:8003";
       };
     };
+    virtualHosts."anki.dryb.org" = {
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8004";
+      };
+    };
   };
 
   networking.firewall = {

secrets/passwords/anki/admin.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 OFTJeQ qy/IlsEuP0XEawKBvyf9nIsmARBbYDUtouzhieRxFB0
+2213E7TV/oEGhALPuNFAIwuumgMRx486ByZNysUw/08
+-> ssh-ed25519 lfMVeg 2wp3FfkpCQuVxOXF2ktm/U2GTgyzuApgVEF0QZvpXxQ
+xiQAwbQRCm+Gb7O9Fcmz+rc04iLtqx0nLWAVYLQPqqE
+-> ssh-ed25519 ueRyzQ 6wgTBHLIsmLGq2xfsjMUsTiiASd9GZQhxw52wxHRBGA
+AJ9KNhbddyGNmQU87g/HAVGr/wmA/oW87Y1wbiLpvDA
+--- jSgMMjdLvp9KbRehjZuxUdqw5ZeAemjT/4hugiQ4j6s
+ íœÊq,¸ôôK?ÞÛ<C39E>	÷'ŒØcç;i~“DOÛÅc$û	}j¶`á <C3A1>‡¬	ˆ¶Ž€|åŽg5†eËÜÚ+d11ÒJÆeýr·I·Œ

secrets/secrets.nix

@@ -20,4 +20,5 @@ let
 in
 {
   "passwords/gitea/db.age".publicKeys = users ++ [ APPA ];
+  "passwords/anki/admin.age".publicKeys = users ++ [ APPA ];
 }