1{lib, ...}: {
 2  den.aspects.services.ntfy-sh = {
 3    settings.host = {
 4      domain = lib.mkOption {
 5        type = lib.types.str;
 6      };
 7      address = lib.mkOption {
 8        type = lib.types.str;
 9        default = "127.0.0.1";
10      };
11      port = lib.mkOption {
12        type = lib.types.port;
13        default = 5492;
14      };
15    };
16
17    persist = {
18      directories = [
19        {
20          directory = "/var/lib/ntfy-sh";
21          user = "ntfy-sh";
22          group = "ntfy-sh";
23          mode = "0700";
24        }
25      ];
26    };
27
28    reverseProxy = {host, ...}: let
29      cfg = host.settings.services.ntfy-sh;
30    in {
31      ${cfg.domain} = {
32        port = cfg.port;
33      };
34    };
35
36    nixos = {
37      host,
38      config,
39      ...
40    }: let
41      cfg = host.settings.services.ntfy-sh;
42    in {
43      services.ntfy-sh = {
44        enable = true;
45        environmentFile = config.vaultix.templates.ntfy-sh-env.path;
46        settings = {
47          listen-http = "${cfg.address}:${toString cfg.port}";
48          base-url = "https://${cfg.domain}";
49          auth-file = "/var/lib/ntfy-sh/user.db";
50          auth-default-access = "deny-all";
51          auth-access = [
52            "*:up*:wo"
53          ];
54        };
55      };
56
57      systemd.services.ntfy-sh.serviceConfig.DynamicUser = lib.mkForce false;
58
59      vaultix.secrets = {
60        ntfy-sh-passwd-hpcesia.file = ./passwd-hpcesia.age;
61      };
62
63      vaultix.templates.ntfy-sh-env = {
64        content = let
65          authUsersEnv =
66            lib.concatMapAttrsStringSep ","
67            (user: {
68              passwd,
69              role,
70            }: "${user}:${passwd}:${role}")
71            authUsers;
72          authUsers = {
73            hpcesia = {
74              passwd = config.vaultix.placeholder.ntfy-sh-passwd-hpcesia;
75              role = "admin";
76            };
77          };
78        in ''
79          NTFY_AUTH_USERS=${authUsersEnv}
80        '';
81      };
82    };
83  };
84}