feat(grocy): barcode buddy

nixos/access/grocy.nix

@@ -19,7 +19,7 @@ in {
     };
     grocy'local = {
       inherit name;
-      ssl.cert.copyFromVhost = "zigbee2mqtt";
+      ssl.cert.copyFromVhost = "grocy";
       local.enable = mkDefault true;
       locations."/" = mkIf (!grocy.enable) {
         proxyPass = mkDefault (if grocy.enable

nixos/barcodebuddy.nix

@@ -0,0 +1,38 @@
+{config, lib, ...}: let
+  inherit (lib.modules) mkDefault;
+  inherit (config.services) nginx;
+  cfg = config.services.barcodebuddy;
+in {
+  config.services.barcodebuddy = {
+    enable = mkDefault true;
+    hostName = mkDefault "barcodebuddy";
+    reverseProxy.enable = mkDefault true;
+    settings = {
+      EXTERNAL_GROCY_URL = "https://grocy.${config.networking.domain}";
+      DISABLE_AUTHENTICATION = true;
+    };
+    nginxPhpConfig = ''
+      include ${config.sops.secrets.barcodebuddy-fastcgi-params.path};
+    '';
+  };
+  config.services.nginx.virtualHosts.barcodebuddy = {
+    vouch = {
+      enable = true;
+      requireAuth = false;
+    };
+    name.shortServer = mkDefault "bbuddy";
+    locations = {
+      "= /api/index.php" = {
+        vouch.requireAuth = false;
+        extraConfig = cfg.nginxPhpConfig;
+      };
+      "~ \\.php$" = {
+        vouch.requireAuth = true;
+      };
+    };
+  };
+  config.sops.secrets.barcodebuddy-fastcgi-params = {
+    sopsFile = mkDefault ./secrets/barcodebuddy.yaml;
+    owner = mkDefault nginx.user;
+  };
+}

nixos/base/nixpkgs.nix

@@ -2,6 +2,7 @@
   nixpkgs = {
     overlays = [
       inputs.arcexprs.overlays.default
+      (import ../../overlays/barcodebuddy.nix)
       (import ../../overlays/samba.nix)
       (import ../../overlays/nginx.nix)
     ];

nixos/secrets/barcodebuddy.yaml

@@ -0,0 +1,120 @@
+barcodebuddy-fastcgi-params: ENC[AES256_GCM,data:Ja1gkFypwLgdQyJWQljtkcmlJ4nKw8CACXIe9CXQduwv2wZdiAZcoulX6+kjPxHLMsdTuvWFbVY4GfBVWh6LmySLgR6tIwmNiNg7ncgVEQbeTK75HQFWviVDu13GjYQU7YCBB438gX2X2aPHb25EcLU6UQgzHyCetO6nG9/T9OhKmmS0UUXCG1JykWQqfHPpjddydRYw08ZseZHhcyPzXAwdoJZsgVs1KhbvCUuMJctCfFEwCesYXcGM6eTPg9N8+hqAa13ijkQ8NzmamUau45pmrRbUJOm+OXi0TjO8KYIkQg7bua64oO3DegzFmeFeqnSAmlIcvZw=,iv:tI+RtXAWKbx3jQ1QfuCcoEoXPq9oze0QjrwQ5mcDe0U=,tag:Fa8fODz6hQu09yaf3HyqXg==,type:str]
+sops:
+    shamir_threshold: 1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age12ze362pu5mza6ef9akrptr7hfe4auaqul4rkta7kyy2tnrstqensgmujeq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvYVJGSFBRRnNnN0VFY3hj
+            elBraEpLWjhBZnhNWFpSU2w2bWo0YUpFQ0RvCkJNSUVucHRQYnViQnlyQi85c2NN
+            MEIyTjRCV2lFOFU5UmRPT1BZeUtNeGMKLS0tIDBVRVV0K1hOeVZOZWZxNzZGeVZ2
+            b1NZMDNvNnBkU012NERxODRGWUhGeEEKYU1FtcFfOEVAyHd4kPJQTHSjIrghZJRx
+            Y56m4F4ZLUjHTdW67t0B6n8HMxkd9FkPMNcdevXjo1EJje7OkTFPbQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age176uyyyk7veqnzmm8xzwfhf0u23m6hm02cldlfkldunqe6std0gcq6lg057
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPeDJsSDBJSU5QeDZzWGRG
+            VjVsSW9xNU1NSVRLYzlqMWdrYllMeTV1eVY0ClBVOUt0VzkvYVFHY2pvYjNLOWRU
+            bXIySGtvckRlbzZ0dWFIYWpsUlpsYXcKLS0tIGk3bTFYYm4veHU5WVM3RmlHSlZG
+            SU5ZSklscGp4VTBBSnFMMWp4Q2RoSG8KZs+4ZqdkbxljhlqXShO3hazTBYyMZpR6
+            7kFuV3SA/NawP+1rRunB68PG2OgZAsOdEMghQcDjvXUCDPnolVWElg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15hmlkd9p5rladsjzpmvrh6u34xvggu9mzdsdxdj3ms43tltxeuhq4g7g9k
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjTHFDcHpBcFEvUDg5TEg4
+            QVdCNG9xeUViQ3AyOGxyYWJudVNzZFNxWmpJCjVsa0FzSzNyTmsrRXRESXhpMi9v
+            WHZ2RERMQUNoc0h1R0hFRkRkK29yRUkKLS0tIDdKdHlZUGVXM0ZQNnZ0Sk11clZ1
+            ajRGNWRvZ2FjV215dUcxZjM1Y3U1L2MK2F3SM/aDXAxBYMySZcBxTstYEQ6fU9lg
+            SSsH2QX6XkHsC8LExGzEW/OPSAf7tfxKmGiMM/YHmKo0XkthjMdw5Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10t6kc5069cyky929vvxk8aznqyxpkx3k5h5rmlyz83xtjmr22ahqe8mzes
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKSnBMSGJtWHZyNHZEVzdo
+            M1VtNU9lcWViZnFjT0FFMHltMFdEL0R0Mm5VCnBZb0ljcHNpSVY5em5sN3lJc0dx
+            QXZuM3BONzVzcUtOb3hVbGF5MFJlT00KLS0tIGp2YmZ4MUVWc01ESjhsSll1UWFo
+            eVU2TGs3QzhOcU00UjhQWjBZU1VDeUkK/E/ff/ZTOmMmxhwAbAA1K/HOXGx9bhdE
+            HD079kH0nAD4+lBA2lzDz8CDKVOU0QNratxZwOJd4yZUm917We4kQA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1a2quf2ekkj94ygu7wgvhrvh44fwn32c0l2cwvgvjh23wst90s54szdsvgr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3M2FydGVtVFlQdVFWd25C
+            NHE4emhCU2pxRmYreG9HQU8vUmFSSXZEZEdZCnRzQnhGZjllUGZFdmhuRHNxWXJz
+            Sk9saDVrRjAyanpuZ21oZlNWeGNMZncKLS0tIEx3M21tTjR6UXhlcHE4VG56NllH
+            WG5uOVA4bmhjaWFpTmtLRXpRSTN5YjAKHb1ztknE6la54ffLnRGM4ellP5vmvSI+
+            SkaXCjzArtbvIDFHL3bp8mpMN6qLpLUgPsI2a2KsED+pX3dcyBNqzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16klpkaut5759dut8mdm3jn0rnp8w6kxyvs9n6ntqrdsayjtd7upqlvw489
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1dUpWOGZub0JtMjhNd2Uv
+            WkJRaEhsaVlpMDM1alFHT1JZakVKakozcWo0ClV0NmgydWZyazE2WFBEU05HUlpq
+            amJiMXpnZG0rNkNjSllrZkZ2cE95bXMKLS0tIEw4cnI2bWNyTncwT3RRQ3JTVTN3
+            NzMxS2lHcUJHUE51WmNWNlRSQ2hoaE0KMrBo1vqsWBK0j90+xqGKUktfaxzFnfQe
+            mUzZZGJBr+wQlPiv2WzlD0eYu4KLy+JxibY6bSIj0bFynO9Z5VsSNQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age13qgddr326g5je0fpq2r3k940vsr3fh9nlvl9xtcxk3xg2x0k3vsq7pvzaj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYc0lORWVBQ29NUnJwWWtp
+            RXo2ejZubFJhL0JES0QrZzZMR05GVGpPWXhFCnh0SUdveWYwTmdQcGNhZnE4anNi
+            VXM0OWhtSEl6Vm1VYW9Pd0c5SHV3VHcKLS0tIFdNNjc3Vk9qS3FVd0tFaWxvSjFL
+            U2tCd2U0MWd5L0pIM21GRi9zM1NZWkkKRxMlIlsx6B5ygAVPqawyRG5vfnz/kuPJ
+            YxNkh3aUkvaIagnMZ/bzjNYV7y6cnBl4M3rzrvHncR0zp9/6QH4jbA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ktmx2szedfnpe5xumnzs8vkk0ffqgga6ved3drtksg9pye6ndsnsnqq488
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUUpVbm40THgwS0IyeE14
+            RjV3aDAyZk9tSjF0Rk4vUzdhMnBnUmxsaUFzCkZKOGxWdGcrYmlPTmI2dVBIOVhG
+            RXBzMlF5WTlsZlhCQmo1cHdYRmJ5OFkKLS0tIDl1bzRLWnk0aUdHM2hQSUVqNmMw
+            YVp2UnlUeVVuMjE1L0VsdEJQdmtlQWcKwuFHmj4KpUk/LGxKu2sHOmN8QsuiZat+
+            p4FswX4i4PDPmZAHYLt69MJIKUDlm3iN/A5Hfa6mX6R4NZjryNdD2w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-22T15:15:33Z"
+    mac: ENC[AES256_GCM,data:N4NB3pSZsh8HTSp14/rj4kZ1dGvJzlP9j6uk9ZciCtNFsEmPLSSojdJfzULUvpbZv+emJHHgXCKORCtJ6xZ0Zn+8u2q/nvEiWQITMl00yeRz2SNanCumtXmT+YdMI0PEK6WnLJSyiq/qr5GQIzYKWZgJRaj7hiu/eTdpglTfZUo=,iv:ybOhB5ZFvdSEyewqVBtXAW5b5i9tUJBAk1GdycRwkMY=,tag:Pl7jQhHmKj8yhQDUyoZHFg==,type:str]
+    pgp:
+        - created_at: "2024-03-22T14:22:11Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA82M54yws73UARAAqF6X9la78YtUjZntDu6j/s/A7+uNO5vIGRwUBathX4K4
+            BQR9JRHMLiloAQCwGMjYUQBcGBlkTYZDh5ToN15YgaU7OLkcPKqWWkNHrmuhhbha
+            HoUVrznU3iqsN4ZyQ7d8Z2WcgulkRO07hiEks8F21Vzdu6r+pU4F4+A+SqnlyfRQ
+            jGiOO1OBmxeYUGbthOcW1wxFByYd+uUKnY+59U/eJxWIXgKhIPbdPPcPdMGF+P46
+            OuLdK8fHMY50lzfn/fa8IlKAM95bsvwxH8PfGKShQCQde1va3xcB+N9uoJvTFZ9t
+            PkmDd7iFKlbN2SGmxI4pBlHanvJ94eB8afGH96aTIQj700vMH95oTvKKnSJWZvUz
+            U1a3pRsnxSqgQ+Dont8VxrhlRyHw3z7GCOE0+Jhau7xY6hN8KpT16gSGAZ5FZ8zs
+            sXkeZcAf5vJPpLsrxIU9XEHY7+zzMyAYOw2MfuMOQhJR9UDlV+gjetIy3CcW6qAR
+            rBg05xJ2Nt6MUNuWdjcMkemME8uJN9a4rn6GkG80h4K4OBnr2+YYWH76bleTkAGx
+            aie2XzURPE/xhDBFAXXUGycgd2h1vLt6cDqgDvmLVUssVCdbZszX31vGabA+/dlX
+            eTdNRsseQC4j9HaTECIFDDvQzWGl3vpFD0EGgvQt8U6Q3xCgXfEOrxP2th/ogE3S
+            XgHz/dGQpfMgvNdYoQ2uYBB6i4k14z7u6sQOPsc6hYTUqaQfx7VH+ji7Pgx9OG0G
+            UlkEpWG8brPffzkz+OcrgH8lm+9+E51z/dzdEDSUa1zMyvD1iXr1eXUUDt8sUbA=
+            =TG+W
+            -----END PGP MESSAGE-----
+          fp: CD8CE78CB0B3BDD4
+        - created_at: "2024-03-22T14:22:11Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMA2W9MER3HLb7AQf+NBCAbsV4DtDVLUAzlb2Z49Fi4tZlEBbcf/vg8fvoS2Y7
+            uGjlkp/t5fc2YoZuZ8gWbzAg2Y4mIs0NgeLcZffAzcZAOOZ24qRYdnIwHNnqR0Ca
+            dSqbYbcXO3yGMDDsSFjcL7l9O/YqR+WntwJBPuhfjVuJ0lNXXYg6r0hVyfVQmAv5
+            x0xLuYttTxCSy4iDfStpTpeiQTFTrqFccBVZZJiIG9TyqQZNRXnrCKXvwZ49nxVE
+            vGMyf6bVPXhqEDjwJ534HvV3AGovwPt8t8OE4ohnau5VVwpqF0U+Jn8tvmvFti5B
+            T6BMtPBkDvSEk+rk7qv4Ak/GwooJ4PgCwVuVVXGXCNJeAUuK5g38Q14p3lBFOt7W
+            u9xhH7c/FsPTAHz221OUi5AXfIZIFsgQVcu2JyzlzgzIC66tzOf2mUrhWRmVD+NY
+            CyfrZcE3N4C7392MTqFnemJtbYDOJ+YRW7pCMzEoBQ==
+            =z+BG
+            -----END PGP MESSAGE-----
+          fp: 65BD3044771CB6FB
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1