feat(koi): memos

hosts/koi/configuration.nix

@@ -32,6 +32,7 @@
     ./containers/zond
     ./containers/kanidm
     ./containers/siyuan
+    ./containers/memos
     ./containers/teisu.nix
     ./containers/bots/pcre-sub-bot.nix
     ./containers/bots/channel-logger-bot.nix

hosts/koi/containers/kanidm/default.nix

@@ -32,7 +32,7 @@ in {
       "${(secrets.file config "kanidm-tls-cert")}:/data/chain.pem"
     ];
     
-    user = "${builtins.toString UID}:60";
+    user = "${builtins.toString UID}";
   };
 
   systemd.tmpfiles.rules = [

hosts/koi/containers/memos/default.nix

@@ -0,0 +1,44 @@
+{ abs, pkgs, config, ... }@inputs:
+
+let 
+  UID = 1114;
+in {
+  users.users.memos = {
+    isNormalUser = true;
+    uid = UID;
+  };
+
+  services.postgresql.ensureUsers = [
+    { name = "memos"; ensureDBOwnership = true; }
+  ];
+  services.postgresql.ensureDatabases = [ "memos" ];
+  desu.postgresql.ensurePasswords.memos = "memos";
+
+  virtualisation.oci-containers.containers.memos = {
+    image = "neosmemo/memos:0.22.5";
+    volumes = [
+      "/srv/memos/data:/var/opt/memoss"
+    ];
+
+    environment = {
+      MEMOS_DRIVER = "postgres";
+      MEMOS_DSN = "postgresql://memos:memos@172.17.0.1:5432/memos?sslmode=disable";
+    };
+    
+    user = "${builtins.toString UID}";
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /srv/memos/data 0700 ${builtins.toString UID} ${builtins.toString UID} -"
+  ];
+
+  services.nginx.virtualHosts."lore.stupid.fish" = {
+    forceSSL = true;
+    useACMEHost = "stupid.fish";
+
+    locations."/" = {
+      proxyPass = "http://memos.docker:5230$request_uri";
+      proxyWebsockets = true;
+    };
+  };
+}