feat(madoka): uptime-kuma

hosts/madohomu/common.nix

@@ -21,5 +21,8 @@
     (abs "ssh/teidesu.pub")
   ];
 
+  virtualisation.docker.enable = true;
+  virtualisation.oci-containers.backend = "docker";
+  
   system.stateVersion = "23.11";
 }

hosts/madohomu/madoka.nix

@@ -3,6 +3,7 @@
 {
   imports = [
     ./common.nix
+    ./services/uptime-kuma.nix
   ];
   
   networking.hostName = "madoka";

hosts/madohomu/services/uptime-kuma.nix

@@ -0,0 +1,40 @@
+{ abs, config, ... }:
+
+let 
+  secrets = import (abs "lib/secrets.nix");
+
+  UID = 1100;
+in {
+  # we use cf tunnels because 443 port is used by the proxy,
+  # and it's also generally easier
+  imports = [
+    (secrets.declare [{
+      name = "madohomu-cf-token";
+      owner = "uptime-kuma";
+    }])
+  ];
+
+  users.users.uptime-kuma = {
+    isNormalUser = true;
+    uid = UID;
+  };
+  users.groups.uptime-kuma = {};
+
+  virtualisation.oci-containers.containers.uptime-kuma = {
+    image = "louislam/uptime-kuma:1.23.13-debian";
+    volumes = [
+      "/srv/uptime-kuma:/app/data"
+    ];
+    environment = {
+      PUID = builtins.toString UID;
+      PGID = builtins.toString UID;
+    };
+    environmentFiles = [
+      (secrets.file config "madohomu-cf-token")
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /srv/uptime-kuma 0700 ${builtins.toString UID} ${builtins.toString UID} -"
+  ];
+}