add dnote

flake.lock

@@ -96,6 +96,22 @@
         "type": "github"
       }
     },
+    "dnote": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1719733391,
+        "narHash": "sha256-MRUkFWeL9aOtqWVLLbYvQXANUF/00BXo7H/szvfybdE=",
+        "owner": "dnote",
+        "repo": "dnote",
+        "rev": "895dcaa59f1c649f0a5d5703e08ae6a96304d03d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "dnote",
+        "repo": "dnote",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -714,6 +730,7 @@
         "agenix": "agenix",
         "auto-cpufreq": "auto-cpufreq",
         "commander-nvim": "commander-nvim",
+        "dnote": "dnote",
         "flake-parts": "flake-parts",
         "gen-nvim": "gen-nvim",
         "gtrackmap": "gtrackmap",

flake.nix

@@ -56,6 +56,10 @@
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    dnote = {
+      url = "github:dnote/dnote";
+      flake = false;
+    };
   };
   outputs = { flake-parts, agenix, nixpkgs, ... }@inputs:
     flake-parts.lib.mkFlake { inherit inputs; } (

home/common/default.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, inputs, ... }:
 {
   nixpkgs.config.allowUnfree = true;
-  imports = [ ../gnome ../custom-programs ./neovim ];
+  imports = [ ../gnome ../custom-programs ./neovim ./dnote.nix ];
 
   # This value determines the Home Manager release that your configuration is
   # compatible with. This helps avoid breakage when a new Home Manager release
@@ -72,6 +72,7 @@
       enable = true;
       flake = "/etc/nixos";
     };
+    dnote.enable = true;
     home-manager.enable = true;
     bat = {
       enable = true;

home/common/dnote.nix

@@ -0,0 +1,35 @@
+{ inputs, lib, pkgs, config, ... }:
+let
+  completion = pkgs.stdenv.mkDerivation {
+    name = "dnote-completion";
+    phases = [ "unpackPhase" "installPhase" ];
+    src = inputs.dnote;
+    installPhase = ''
+      mkdir -p $out/lib/dnote/zsh-completion/completions
+      cp pkg/cli/dnote-completion.zsh $out/lib/dnote/zsh-completion/completions/_dnote
+    '';
+  };
+  client = pkgs.stdenv.mkDerivation {
+    name = "dnote-client";
+    phases = [ "installPhase" ];
+    installPhase = ''
+      mkdir -p $out/bin
+      cp ${unstablePkgs.dnote}/bin/dnote-cli $out/bin/dnote
+    '';
+  };
+  cfg = config.programs.dnote;
+  unstablePkgs = inputs.nixpkgs-unstable.legacyPackages.${pkgs.system};
+in
+{
+  options.programs.dnote = {
+    enable = pkgs.lib.mkEnableOption "Enable dnote";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [ client ];
+    home.shellAliases.dn = "dnote";
+    programs.zsh.initExtra = ''
+      fpath=(${completion}/lib/dnote/zsh-completion/completions $fpath)
+    '';
+  };
+}

hosts/freun.dev/secrets.nix

@@ -10,6 +10,7 @@
         "storage-box-credentials"
         "vaultwarden"
         "donetick"
+        "dnote"
       ]
     ) // {
     smtp-password = {

hosts/freun.dev/services.nix

@@ -9,6 +9,7 @@ let
     from = "noreply@${config.networking.domain}";
     heloName = config.networking.domain;
   };
+  secrets = config.age.secrets;
 in
 {
   services.postgresql.package = pkgs.postgresql_16;
@@ -149,5 +150,16 @@ in
         videoConversion.concurrency = 2;
       };
     };
+
+    dnote = {
+      enable = true;
+      subdomain = "note";
+      environment = {
+        SmtpHost = smtp.host;
+        SmtpPort = smtp.port;
+        SmtpUsername = smtp.username;
+      };
+      environmentFile = secrets.dnote.path;
+    };
   };
 }

modules/services/default.nix

@@ -16,5 +16,6 @@
     ./workout-sync.nix
     ./readeck.nix
     ./donetick.nix
+    ./dnote.nix
   ];
 }

modules/services/dnote.nix

@@ -0,0 +1,129 @@
+{ lib, inputs, config, pkgs, ... }:
+let
+  cfg = config.services.dnote;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+  pkgsUnstable = inputs.nixpkgs-unstable.legacyPackages.${pkgs.system};
+
+  types = {
+    environment = lib.types.submodule {
+      options = {
+        DBName = lib.mkOption {
+          type = lib.types.str;
+          default = "dnote";
+        };
+        SmtpHost = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+        SmtpPort = lib.mkOption {
+          type = lib.types.nullOr lib.types.int;
+          default = null;
+        };
+        SmtpUsername = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+        SmtpPassword = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+      };
+    };
+  };
+
+  immutableEnvironment = {
+    GO_ENV = "PRODUCTION";
+    OnPremises = true;
+    DBHost = "/var/run/postgresql";
+    DBPort = config.services.postgresql.settings.port;
+    DBUser = cfg.user;
+    WebURL = "https://${fqdn}";
+  };
+
+  serializeEnvVar = value:
+    if (lib.isBool value)
+    then if value then "true" else "false"
+    else toString value;
+in
+{
+  options.services.dnote = {
+    enable = lib.mkEnableOption "Enable dnote server";
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "dnote";
+    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 3040;
+    };
+    environment = lib.mkOption {
+      type = types.environment;
+      default = { };
+    };
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users = {
+      users.${cfg.user} = {
+        isSystemUser = true;
+        group = cfg.user;
+      };
+      groups.${cfg.user} = { };
+    };
+
+    systemd.services.dnote = {
+      enable = true;
+      description = "Dnote server";
+      environment = lib.mapAttrs (_: value: serializeEnvVar value) (cfg.environment // immutableEnvironment);
+      serviceConfig = {
+        ExecStart = "${pkgsUnstable.dnote}/bin/dnote-server -port ${toString cfg.port} start";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        User = cfg.user;
+        BindPaths = [
+          "/var/run/postgresql"
+        ];
+        BindReadOnlyPaths = [
+          /run/systemd/resolve/stub-resolv.conf
+          /etc/ssl
+          /etc/static/ssl
+          /etc/resolv.conf
+          /etc/static/resolv.conf
+          /etc/nsswitch.conf
+          /etc/static/nsswitch.conf
+          /etc/hosts
+        ];
+      };
+      confinement = {
+        enable = true;
+        packages = [ pkgs.cacert ];
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    services = {
+      postgresql = {
+        enable = lib.mkDefault true;
+        ensureDatabases = [ cfg.environment.DBName ];
+        ensureUsers = [{
+          name = cfg.user;
+          ensureDBOwnership = true;
+        }];
+      };
+
+      webserver = {
+        enable = lib.mkDefault true;
+        vHosts.${fqdn} = {
+          proxyBuffering = false;
+          locations."/".proxyPort = cfg.port;
+        };
+      };
+    };
+  };
+}

secrets/dnote.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 osOCZA UCilO75OGmYABIVNjQ7JKdObSSC882S6blT35S8XXBE
+CEhIzJeE0Xa9jY1uboPVM1uK+U8N77e6pGsK3SCNBqY
+-> ssh-ed25519 DFiohQ aKyq1IPwKvgQniPEDt9tIw6KLeQePctFPY8wnSmcREk
+3OQH5iOGFbnJaUXn8JmMDItPfPjXUmuO1OFYw31ftGA
+-> ssh-ed25519 PT7ffg 1XzR+XsNLJgf0itst++aN4GWpiUjPvlCPR/KcZzLNT4
+Na1BKsjIoFgFbQI4LVppxW53yAQgxQfz5r31HrTNRLI
+--- U8B89Fp3JNPBX18P5p3lVLYIz5CsbxldkvnjZ2Cx4+8
+º“¨3z®#<›Kî*Žw
ÁMs!­Ó2¼Ê<C2BC>bqz>‰&€~u«¹‡Êi𧾘tYv§¾ÁþítÂøÒvÀ¬2Ïd)gfÇÃÙÔ<C399>

secrets/secrets.nix

@@ -18,4 +18,5 @@ in
   "smtp-password.age".publicKeys = users ++ [ freun-dev ];
   "readeck.age".publicKeys = users ++ [ freun-dev ];
   "donetick.age".publicKeys = users ++ [ freun-dev ];
+  "dnote.age".publicKeys = users ++ [ freun-dev ];
 }