feat(mealie): configure oidc authentication

2026-09-09 03:36:07 +00:00 · 2026-09-06 18:56:48 +00:00
parent 01ee98155a
commit f593fdb81f
4 changed files with 57 additions and 10 deletions
@@ -0,0 +1,67 @@
+{ config, lib, ... }:
+
+let
+  inherit (config.nmasur.settings) hostnames;
+  cfg = config.nmasur.presets.services.mealie;
+in
+
+{
+
+  options.nmasur.presets.services.mealie.enable = lib.mkEnableOption "mealie recipe manager";
+  config = lib.mkIf cfg.enable {
+
+    secrets.mealie-oidc-secret = {
+      source = ./mealie-oidc-secret.age;
+      dest = "${config.secretsDirectory}/mealie-oidc-secret";
+      prefix = "OIDC_CLIENT_SECRET=";
+    };
+    systemd.services.mealie-oidc-secret-secret = {
+      requiredBy = [ "mealie.service" ];
+      before = [ "mealie.service" ];
+    };
+
+    services.mealie = {
+      enable = true;
+      port = 9099;
+      database.createLocally = true;
+      listenAddress = "127.0.0.1";
+      credentialsFile = config.secrets.mealie-oidc-secret.dest;
+      settings = {
+        TOKEN_TIME = 7200; # Hours for login to last (300 days)
+        OIDC_AUTH_ENABLED = "true";
+        OIDC_SIGNUP_ENABLED = "true";
+        OIDC_CONFIGURATION_URL = "https://${hostnames.auth}/.well-known/openid-configuration";
+        OIDC_CLIENT_ID = "040925ed-b39e-4442-b8e8-369c948c0cd2";
+        OIDC_PROVIDER_NAME = "Pocket ID";
+        OIDC_USER_CLAIM = "email";
+      };
+    };
+
+    systemd.services.mealie = {
+      after = [ "mealie-oidc-secret-secret.service" ];
+    };
+
+    # Fix BASE_URL for downloading backups
+    systemd.services.mealie.environment.BASE_URL = lib.mkForce "https://${hostnames.recipes}";
+
+    nmasur.presets.services.caddy.routes = [
+      {
+        match = [ { host = [ hostnames.recipes ]; } ];
+        handle = [
+          {
+            handler = "reverse_proxy";
+            upstreams = [ { dial = "localhost:${toString config.services.mealie.port}"; } ];
+          }
+        ];
+      }
+    ];
+
+    # Configure Cloudflare DNS to point to this machine
+    services.cloudflare-dyndns.domains = [ hostnames.recipes ];
+
+    # Point localhost to the local domain
+    networking.hosts."127.0.0.1" = [ hostnames.recipes ];
+
+  };
+
+}