Commit 2bcb276

@@ -0,0 +1,144 @@
+{lib, ...}: {
+  den.aspects.services.stash = {
+    settings = {
+      external = lib.mkEnableOption "Whether to expose Stash service to public internet";
+      domain = lib.mkOption {
+        type = lib.types.str;
+      };
+      address = lib.mkOption {
+        type = lib.types.str;
+        default = "127.0.0.1";
+      };
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 9482;
+      };
+      jwtSecretKeyFileAged = lib.mkOption {
+        type = lib.types.path;
+      };
+      sessionStoreKeyFileAged = lib.mkOption {
+        type = lib.types.path;
+      };
+      passwordFileAged = lib.mkOption {
+        type = lib.types.path;
+      };
+    };
+
+    persist = {config, ...}: {
+      directories = [
+        {
+          directory = lib.dirOf config.services.stash.settings.database;
+          inherit (config.services.stash) user group;
+        }
+        {
+          directory = config.services.stash.settings.blobs_path;
+          inherit (config.services.stash) user group;
+        }
+      ];
+    };
+
+    cache = {config, ...}: {
+      directories =
+        [
+          {
+            directory = lib.dirOf config.services.stash.settings.cache;
+            inherit (config.services.stash) user group;
+          }
+          {
+            directory = config.services.stash.settings.generated;
+            inherit (config.services.stash) user group;
+          }
+        ]
+        ++ (lib.optional config.services.stash.mutablePlugins {
+          directory = config.services.stash.settings.plugins_path;
+          inherit (config.services.stash) user group;
+        })
+        ++ (lib.optional config.services.stash.mutableScrapers {
+          directory = config.services.stash.settings.scrapers_path;
+          inherit (config.services.stash) user group;
+        });
+    };
+
+    reverseProxy = {host, ...}: let
+      cfg = host.settings.services.stash;
+    in
+      lib.optionalAttrs (cfg.external) {
+        ${cfg.domain} = {
+          port = cfg.port;
+        };
+      };
+
+    reverseProxyTailscale = {host, ...}: let
+      cfg = host.settings.services.stash;
+    in
+      lib.optionalAttrs (!cfg.external) {
+        ${cfg.domain} = {
+          port = cfg.port;
+        };
+      };
+
+    nixos = {
+      host,
+      config,
+      pkgs,
+      ...
+    }: let
+      cfg = host.settings.services.stash;
+    in {
+      services.stash = {
+        enable = true;
+        mutableSettings = false;
+        mutablePlugins = true;
+        mutableScrapers = true;
+        jwtSecretKeyFile = config.vaultix.secrets.stash-jwt-secret.path;
+        sessionStoreKeyFile = config.vaultix.secrets.stash-session-store-key.path;
+        username = "admin";
+        passwordFile = config.vaultix.secrets.stash-password.path;
+        settings = {
+          host = cfg.address;
+          port = cfg.port;
+
+          blobs_path = lib.mkDefault "${config.services.stash.dataDir}/blobs";
+          cache = "${config.services.stash.dataDir}/cache";
+          database = "${config.services.stash.dataDir}/database/stash-go.sqlite";
+          generated = "${config.services.stash.dataDir}/generated";
+          plugins_path = lib.mkIf config.services.stash.mutablePlugins "${config.services.stash.dataDir}/plugins";
+          scrapers_path = lib.mkIf config.services.stash.mutableScrapers "${config.services.stash.dataDir}/scrapers";
+          preview_segments = 16;
+        };
+      };
+
+      vaultix.secrets = {
+        stash-jwt-secret = {
+          file = cfg.jwtSecretKeyFileAged;
+          owner = config.services.stash.user;
+          inherit (config.services.stash) group;
+        };
+        stash-session-store-key = {
+          file = cfg.sessionStoreKeyFileAged;
+          owner = config.services.stash.user;
+          inherit (config.services.stash) group;
+        };
+        stash-password = {
+          file = cfg.passwordFileAged;
+          owner = config.services.stash.user;
+          inherit (config.services.stash) group;
+        };
+      };
+
+      # Original module uses ffmpeg-full instead of ffmpeg-headless
+      # which brings lots of GUI dependenices
+      systemd.services.stash.path = lib.mkForce (with pkgs; [
+        ffmpeg-headless
+        python3
+        ruby
+
+        coreutils
+        findutils
+        gnugrep
+        gnused
+        systemd
+      ]);
+    };
+  };
+}