feat(mealie): configure oidc authentication

docs/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## 2026-09-06
 
+- **Configured OpenID Connect (OIDC) authentication for Mealie**:
+  - Configured `services.mealie.settings` with OIDC settings pointing to Pocket ID (`auth.masu.rs`), using client ID `040925ed-b39e-4442-b8e8-369c948c0cd2`.
+  - Added secret management for `mealie-oidc-secret.age` via `secrets.mealie-oidc-secret`, using `prefix = "OIDC_CLIENT_SECRET="` to generate an environment file.
+  - Configured `services.mealie.credentialsFile` to load the client secret via systemd's `EnvironmentFile` without exposing it in the world-readable Nix store or systemd unit file.
+  - Configured `systemd.services.mealie` to order after `mealie-oidc-secret-secret.service`.
+  - Updated `docs/oidc-services.md` with the verified configuration and callback URI (`https://cooking.masu.rs/login`).
+
 - **Configured OpenID Connect (OIDC) authentication for Actual Budget**:
   - Configured `services.actual.settings` with `loginMethod = "openid"` and `openId` settings pointing to Pocket ID (`auth.masu.rs`), using client ID `92afe9f8-7ef6-42ab-8a06-701df3c7179d`.
   - Added secret management for `actualbudget-oidc-secret.age` via `secrets.actualbudget-oidc-secret`, set with owner `actualbudget` and group `shared` (0440).

docs/oidc-services.md

@@ -31,7 +31,7 @@ These services support OpenID Connect natively without requiring external authen
 | **Nextcloud** | `cloud.masu.rs` | Native (official `user_oidc` app) | Nextcloud app + `nextcloud-occ user_oidc:provider` |
 | **Grafana** | `metrics.masu.rs` | Native (Generic OAuth) | NixOS config (`services.grafana.settings."auth.generic_oauth"`) |
 | **Paperless-ngx** | `paper.masu.rs` | Native (`django-allauth`) | NixOS env vars (`PAPERLESS_SOCIALACCOUNT_PROVIDERS`) |
-| **Mealie** | `cooking.masu.rs` | Native core feature | NixOS env vars (`OIDC_AUTH_ENABLED`, etc.) |
+| **Mealie** | `cooking.masu.rs` | Native core feature | NixOS config (`services.mealie.settings` + `credentialsFile`) |
 | **Karakeep / Hoarder** | `keep.masu.rs` | Native (NextAuth OIDC) | NixOS env vars (`OAUTH_WELLKNOWN_URL`, etc.) |
 | **Audiobookshelf** | `read.masu.rs` | Native core feature (v2.3+) | Web UI (Settings → Authentication) |
 | **Actual Budget** | `money.masu.rs` | Native core feature (v24.3+) | NixOS config (`services.actual.settings.openId`) |
@@ -181,16 +181,18 @@ All client secrets should be encrypted with `agenix` under the respective servic
 
 ### 6. Mealie (`cooking.masu.rs`)
 - **Pocket ID Redirect URI:** `https://cooking.masu.rs/login`
-- **Setup in `mealie.nix`:**
+- **Setup in `mealie/mealie.nix`:**
   ```nix
-  systemd.services.mealie.environment = {
+  services.mealie = {
-    OIDC_AUTH_ENABLED = "true";
+    credentialsFile = config.secrets.mealie-oidc-secret.dest;
-    OIDC_SIGNUP_ENABLED = "true";
+    settings = {
-    OIDC_CONFIGURATION_URL = "https://auth.masu.rs/.well-known/openid-configuration";
+      OIDC_AUTH_ENABLED = "true";
-    OIDC_CLIENT_ID = "mealie";
+      OIDC_SIGNUP_ENABLED = "true";
-    OIDC_CLIENT_SECRET = "...";
+      OIDC_CONFIGURATION_URL = "https://${hostnames.auth}/.well-known/openid-configuration";
-    OIDC_PROVIDER_NAME = "Pocket ID";
+      OIDC_CLIENT_ID = "040925ed-b39e-4442-b8e8-369c948c0cd2";
-    OIDC_USER_CLAIM = "email";
+      OIDC_PROVIDER_NAME = "Pocket ID";
+      OIDC_USER_CLAIM = "email";
+    };
   };
   ```
 

platforms/nixos/modules/nmasur/presets/services/mealie/mealie-oidc-secret.age

@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBhZWw0
+UTJSYitUUTY0b3A3RDZZTjhnWjh3QWdTaFBzZVRpRWs2UW43R3k0Cmg1ODRWWnI5
+TFdSbmtlTU9zdzhyTHpzMW1hNmk3Tk1sRjZlbFYwZURML1kKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIHVvaGZjeVh3Zm8yWUcyMEZnb1VITHpveGY4aWxTOVhUTzVpbnI0
+c2lYQ0EKNHI4ZEVpUWFYRjVxTTUrTElwdTliWVc2RjdJT21wTTFtSi9ydUo1MVF3
+UQotPiBzc2gtZWQyNTUxOSBuanZYNUEgODhzWTIwVjJvZzZKWGJKNkNHRXFSOWI2
+bDZab1hLUFBOUmNBZXhEQUtoNAozRXBXNUF6THN4Ry9OcG9mb0pTNGZrL01zTzhr
+QWZpRHg1dUNtdnFJTnhNCi0+IHNzaC1lZDI1NTE5IENxSU9VQSA2NWYza2ZDWmda
+N3Eycll2cXNPM0Q3UVk5OHlta1p5OTU3QlQwY3dxNm1NCktLaUxVTkYwMFpZV1px
+SUFUU1JYZ0pyUU9oRURKWVNVck5VSXdVT3N3b0UKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IGZNV3NRWVg5N3FQeUdKYjhwQ2xydzBsaUZDVzl5Y1BrTlhZNCtOOWduZ28K
+dnozT0lFa2NsYW9hbGpTL2pNK1YwcjM2QkVoWHJUUVdjT09XMlJGNUx0RQotLS0g
+My9aVWJuVlBQbTNYZWd2bXUzUGp0NzZXcmFicXNob2ROeWY1cnViWXNQRQpYZ/zy
+L37ulzvRl/Wt2+tIz9fgfOtK2KHuagnPD27T9e8bC9oVinJngwrzfFsV4t7/GCCs
+iI+gfp86+RPSbIwrCA==
+-----END AGE ENCRYPTED FILE-----

platforms/nixos/modules/nmasur/presets/services/mealie/mealie.nix

@@ -10,16 +10,37 @@ in
   options.nmasur.presets.services.mealie.enable = lib.mkEnableOption "mealie recipe manager";
   config = lib.mkIf cfg.enable {
 
+    secrets.mealie-oidc-secret = {
+      source = ./mealie-oidc-secret.age;
+      dest = "${config.secretsDirectory}/mealie-oidc-secret";
+      prefix = "OIDC_CLIENT_SECRET=";
+    };
+    systemd.services.mealie-oidc-secret-secret = {
+      requiredBy = [ "mealie.service" ];
+      before = [ "mealie.service" ];
+    };
+
     services.mealie = {
       enable = true;
       port = 9099;
       database.createLocally = true;
       listenAddress = "127.0.0.1";
+      credentialsFile = config.secrets.mealie-oidc-secret.dest;
       settings = {
         TOKEN_TIME = 7200; # Hours for login to last (300 days)
+        OIDC_AUTH_ENABLED = "true";
+        OIDC_SIGNUP_ENABLED = "true";
+        OIDC_CONFIGURATION_URL = "https://${hostnames.auth}/.well-known/openid-configuration";
+        OIDC_CLIENT_ID = "040925ed-b39e-4442-b8e8-369c948c0cd2";
+        OIDC_PROVIDER_NAME = "Pocket ID";
+        OIDC_USER_CLAIM = "email";
       };
     };
 
+    systemd.services.mealie = {
+      after = [ "mealie-oidc-secret-secret.service" ];
+    };
+
     # Fix BASE_URL for downloading backups
     systemd.services.mealie.environment.BASE_URL = lib.mkForce "https://${hostnames.recipes}";