nixos-config/modules/system/webServices/outline.nix

{
  config,
  pkgs,
  lib,
  ...
}:
let
  cfg = config.custom.services.outline;
in
{
  options.custom.services.outline = {
    enable = lib.mkEnableOption "";
    domain = lib.mkOption {
      type = lib.types.nonEmptyStr;
      default = "";
    };
    port = lib.mkOption {
      type = lib.types.port;
      default = 32886;
    };
    doBackups = lib.mkEnableOption "";
  };

  config = lib.mkIf cfg.enable {
    meta = {
      domains.list = [ cfg.domain ];
      ports.tcp.list = [ cfg.port ];
    };

    sops.secrets."outline/gitlab-auth-secret" = {
      owner = config.users.users.outline.name;
      restartUnits = [ "outline.service" ];
    };

    services.outline = {
      enable = true;
      publicUrl = "https://${cfg.domain}";
      inherit (cfg) port;
      forceHttps = false;
      storage.storageType = "local";

      # See https://docs.getoutline.com/s/hosting/doc/rate-limiter-HSqErsUgXH
      rateLimiter = {
        enable = true;
        requests = 1000;
      };

      # See https://docs.getoutline.com/s/hosting/doc/gitlab-GjNVvyv7vW
      oidcAuthentication =
        let
          baseURL = "https://code.fbi.h-da.de/oauth";
        in
        {
          clientId = "3153f617736d608c0c10ddc4dd83f16c6a1f1b92d7f09a0493a924d389244295";
          clientSecretFile = config.sops.secrets."outline/gitlab-auth-secret".path;
          authUrl = "${baseURL}/authorize";
          tokenUrl = "${baseURL}/token";
          userinfoUrl = "${baseURL}/userinfo";
          usernameClaim = "username";
          displayName = "GitLab";
          scopes = [
            "openid"
            "email"
          ];
        };
    };

    systemd.services.outline.enableStrictShellChecks = false;

    custom =
      let
        dataDir = "/var/lib/outline";
        inherit (config.services.outline) user;
      in
      {
        services.resticBackups.outline = lib.mkIf cfg.doBackups {
          conflictingService = "outline.service";
          paths = [ dataDir ];
          extraConfig.backupPrepareCommand = ''
            ${lib.getExe pkgs.sudo} --user=${user} ${lib.getExe' config.services.postgresql.package "pg_dump"} outline --format=custom --file=${dataDir}/db.dump
          '';
          restoreCommand.postRestore = "sudo --user=${user} pg_restore --clean --if-exists --dbname outline ${dataDir}/db.dump";
        };

        persist.directories = [
          dataDir
          config.services.postgresql.dataDir
        ];
      };
  };
}