plausible: init

hosts/best/plausible/default.nix

@@ -0,0 +1,39 @@
+{ config, self, lib, ... }: let
+  inherit (config.networking) domain;
+  inherit (lib) enabled merge;
+
+  fqdn = "shekels.${domain}";
+  port = 8007;
+in {
+  imports = [
+    (self + /modules/nginx.nix)
+    (self + /modules/postgresql.nix)
+  ];
+
+  secrets.plausibleKey = {
+    file  = ./key.age;
+    owner = "plausible";
+  };
+
+  services.postgresql.ensure = [ "plausible" ];
+
+  services.plausible = enabled {
+    server = {
+      disableRegistration = true; # Setting it explicitly just in case.
+
+      secretKeybaseFile = config.secrets.plausibleKey.path;
+
+      baseUrl = "https://${fqdn}";
+
+      listenAddress = "::1";
+      inherit port;
+    };
+  };
+
+  services.nginx.virtualHosts.${fqdn} = merge config.services.nginx.sslTemplate {
+    locations."/" = {
+      proxyPass       = "http://[::1]:${toString port}";
+      proxyWebsockets = true;
+    };
+  };
+}

hosts/best/plausible/key.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 8y3T6w 6z16kXAqAppYOMXQ7riHs+iP6SFMfJND1KlG0TI+Bgo
+Gm99zghsZ69nBzs8I+Hs3fRM7+dGEaNC7mFwVJZbjO4
+-> ssh-ed25519 CzqbPQ AYm8rfc18ftg7vvt6MVIYlaMcyL09VDoDBLGa0v6STo
+uWmdITsGHXPZfMMBDdaYkbLCHntii4mupaWklLfOYa0
+--- LFjB2mFBC6OkRoM7A9RVGjcXGbMQGKutBz44EDK3YJo
+ｰuL6lｸﾚ6eﾕ燗z<E78797>月ﾓE<EFBE93>'｢Gｺ殻逎､^xjﾉﾔj椴!YEsDZﾓy2紙ｦ<E7B499>rF
瀚Oｿ<4F>K<EFBFBD><4B>剰%ﾌ<>圦ﾈ^秉怖ﾎ<E68096>ｭﾐ┐ｨ∩ﾜY麩屍ﾄyI