Commit d054ea7

@@ -15,6 +15,12 @@
     services.vaultwarden = {
       domain = "vault.hpcesia.com";
     };
+
+    services.wakapi = {
+      external = true;
+      domain = "wakapi.hpcesia.com";
+      passwordSaltFileAged = ./wakapi-password-salt.age;
+    };
   };
 
   den.aspects.hyacine = {
@@ -23,6 +29,7 @@
 
       den.aspects.services.headscale
       den.aspects.services.vaultwarden
+      den.aspects.services.wakapi
     ];
   };
 }

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> piv-p256 xCEwtQ ArMGCYZ4lirDmx5jXklUK7jg8s9w6ZXpVLVUQ8FGjJ/N
+ogybMfNZs+NsC3W+pDbSg6jY1zA4pPDNAY7Xy4ggT+I
+-> ~-grease
+j7PDY+pvPTt8PrPSrjL23gx7aPWhvOZwMxu0GuGKx7Ktdoz3c1VpOeccqrRQIzRo
+DAs2pMwJQxanpuASpNQZoHE
+--- yhRyawIu6199h5q/kNNXrnTRxn2/W/a0HPcagJqZKKk
+� Y1l���<o���ēv���jWd�n�8�.�ޯ�\���h��/�-��0�Y|�s�J���cd��(�f�K����c��D��9s4Ral������
\ No newline at end of file

@@ -0,0 +1,90 @@
+{lib, ...}: {
+  den.aspects.services.wakapi = {
+    settings = {
+      external = lib.mkEnableOption "Whether to expose Wakapi service to public internet";
+      domain = lib.mkOption {
+        type = lib.types.str;
+      };
+      address = {
+        ipv4 = lib.mkOption {
+          type = lib.types.str;
+          default = "127.0.0.1";
+        };
+        ipv6 = lib.mkOption {
+          type = lib.types.str;
+          default = "::1";
+        };
+      };
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 5423;
+      };
+      passwordSaltFileAged = lib.mkOption {
+        type = lib.types.path;
+      };
+    };
+
+    persist = {
+      directories = [
+        {
+          directory = "/var/lib/private/wakapi";
+          user = "nobody";
+          group = "nogroup";
+          mode = "0700";
+        }
+      ];
+    };
+
+    reverseProxy = {host, ...}: let
+      cfg = host.settings.services.wakapi;
+    in
+      lib.optionalAttrs (cfg.external) {
+        ${cfg.domain} = {
+          port = cfg.port;
+        };
+      };
+
+    reverseProxyTailscale = {host, ...}: let
+      cfg = host.settings.services.wakapi;
+    in
+      lib.optionalAttrs (!cfg.external) {
+        ${cfg.domain} = {
+          port = cfg.port;
+        };
+      };
+
+    nixos = {
+      host,
+      config,
+      ...
+    }: let
+      cfg = host.settings.services.wakapi;
+    in {
+      services.wakapi = {
+        enable = true;
+        settings = {
+          server = {
+            listen_ipv4 = cfg.address.ipv4;
+            listen_ipv6 = cfg.address.ipv6;
+            port = cfg.port;
+            public_url = "https://${cfg.domain}";
+          };
+          app = {
+            leaderboard_enabled = false;
+            avatar_url_template = "https://0.gravatar.com/avatar/{email_hash}";
+            date_format = "2006-01-02"; # Go
+            datetime_format = "2006-01-02 15:04";
+          };
+        };
+        environmentFiles = [
+          config.vaultix.templates.wakapi-env.path
+        ];
+      };
+
+      vaultix.secrets.wakapi-password-salt.file = cfg.passwordSaltFileAged;
+      vaultix.templates.wakapi-env.content = ''
+        WAKAPI_PASSWORD_SALT=${config.vaultix.placeholder.wakapi-password-salt}
+      '';
+    };
+  };
+}

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 PtFVIA 3N2AsVuV/wUUKL2q/jmy4bDKyK+ZhcLQ3ioefRlQmk4
+DBD9DBeQGJDbdHP+gJnHx0UenSLmQypdlp+GMdmUbkw
+-> HR2SHr-grease 6!<sDpU# d\C 8:)~ ii
+Hs96GBak6w
+--- 7+rs1Ve6E2LE7on46/WFm7npbt1DURMpcnGZ5CBglr4
+��TcAK0���&xW�M���U::��6yfz&�(�U�c���}�\�M�e�K���І��/�E�]�am�೹
v��5u��ru�6u0�,L	G�
\ No newline at end of file