freun.dev: add glance

modules/services/default.nix

@@ -25,5 +25,6 @@
     ./home-assistant.nix
     ./weechat.nix
     ./hledger-web.nix
+    ./glance.nix
   ];
 }

modules/services/glance.nix

@@ -0,0 +1,45 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.tailscaledGlance;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+  acme = config.security.acme;
+in
+{
+  imports = [
+    (lib.mkAliasOptionModule
+      [ "services" "tailscaledGlance" "settings" ]
+      [ "services" "glance" "settings" ]
+    )
+  ];
+
+  options.services.tailscaledGlance = {
+    enable = lib.mkEnableOption "Enable tailscaled glance";
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale.enable = true;
+    modules.firewall.interfaces.${config.services.tailscale.interfaceName} = [ "dns" ];
+
+    systemd.services.glance.serviceConfig.LoadCredential = [
+      "fullchain.pem:${acme.certs.${fqdn}.directory}/fullchain.pem"
+      "key.pem:${acme.certs.${fqdn}.directory}/key.pem"
+    ];
+
+    services.glance = {
+      enable = cfg.enable;
+    };
+
+    systemd.services.glance = {
+      requires = [ "tailscaled.service" ];
+      after = [ "tailscaled.service" ];
+    };
+
+    services.webserver.vHosts.${fqdn} = {
+      tailscaleAuth = true;
+      locations."/".proxyPort = cfg.settings.server.port;
+    };
+  };
+}