config: Jupiter Domain

flake.lock

@@ -89,11 +89,11 @@
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1787274306,
-        "narHash": "sha256-Qg9f9td5iphUWSQS6zmvyZWO1F+D7j8Z3U6dGyUTg08=",
+        "lastModified": 1786447342,
+        "narHash": "sha256-jA79fFQUEsLcpmjWRrlOgVVFVKUQSD4zOZIRKEpEx88=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "649e823fb24ed118d72e613be35fa8ea1b64afe7",
+        "rev": "da110e01d913bb32bdc06a301c3797e8c42b8ab7",
         "type": "github"
       },
       "original": {
@@ -143,11 +143,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1787144466,
-        "narHash": "sha256-HHfv2/HkNSKbbSyU9iD/g8lbP6r4tl33sSw1W4rXCk0=",
+        "lastModified": 1786437054,
+        "narHash": "sha256-I++HzBBAgQ17UaLVU6aSm1/7LDo6c9xr8rAbpByWywE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "0471accf8d0a8210b31d947497d179ecc99e0021",
+        "rev": "6ed13b1d888d5cb07dbb0723eb1df86bbacd0b9c",
         "type": "github"
       },
       "original": {
@@ -218,11 +218,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1787135253,
-        "narHash": "sha256-M5/r2v++FjVhdsxXYMb4BDJ5YLAdCWFt3aZotcshocA=",
-        "rev": "ffb3c9b700e759be2ef13237c9d8f953b32a1e46",
+        "lastModified": 1786247143,
+        "narHash": "sha256-qemNveuexlWhK0Qc6Y8o+gtSVTIj5xljzTAXQZxTHWA=",
+        "rev": "279b4a8275f032c566576b3f181fa0f27197f588",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1058091.ffb3c9b700e7/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1050399.279b4a8275f0/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
@@ -245,11 +245,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1787101114,
-        "narHash": "sha256-BA7sSNjLDuPGSOYBGpr6WQjke1MQ8AZpJ8GlYZM/mOc=",
-        "rev": "b18a4b905f8d028dc4476412e6d6891728695379",
+        "lastModified": 1786313170,
+        "narHash": "sha256-F5163SsL9xqCLcx8CS2Y5MeLA5z6mfgXGDiCBEqSnbo=",
+        "rev": "fcb8fcd6bf2d0adecae5bd491afaaaf8311b758d",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.8045.b18a4b905f8d/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.7376.fcb8fcd6bf2d/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",

machines/jupiter/environments.nix

@@ -22,7 +22,6 @@ in
     jellyfin.enable = true;
     jellyseerr.enable = true;
     immich.enable = true;
-    newsreader.enable = true;
     development.enable = true;
     home-assistant.enable = true;
 

machines/jupiter/network.nix

@@ -4,7 +4,7 @@ _: {
   ];
 
   networking = {
-    domain = "jupiter.solar.internal";
+    domain = "jupiter";
     search = [ "jupiter.solar.internal" ];
   };
 }

modules/environments/default.nix

@@ -20,6 +20,5 @@
     ./jellyfin
     ./jellyseerr
     ./immich
-    ./newsreader
   ];
 }

modules/environments/homepage/default.nix

@@ -91,10 +91,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [ dashboardPort ];
+
     services.homepage-dashboard = {
       enable = true;
       listenPort = dashboardPort;
-      allowedHosts = "${dashboardHost}:${toString dashboardPort},localhost:${toString dashboardPort},127.0.0.1:${toString dashboardPort},jupiter.solar.internal:${toString dashboardPort}";
+      allowedHosts = "${dashboardHost}:${toString dashboardPort},192.168.178.65:${toString dashboardPort},localhost:${toString dashboardPort},127.0.0.1:${toString dashboardPort},jupiter:${toString dashboardPort},jupiter.solar.internal:${toString dashboardPort}";
       bookmarks = import ./bookmarks.nix;
       services = homepageServices ++ manualServices;
       widgets = config.my.homepage.widgets ++ manualWidgets;

modules/environments/newsreader/default.nix

@@ -1,102 +0,0 @@
-# X (Twitter) news reader: RSSHub feed bridge + Miniflux reader
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.profiles.newsreader;
-  hostName = config.networking.hostName;
-
-  # RSSHub only ever talks to Miniflux on the same host, so it stays on
-  # loopback and out of the firewall.
-  rsshubPort = 1200;
-in
-{
-  options.my.profiles.newsreader = with lib; {
-    enable = mkEnableOption "RSSHub + Miniflux news reader";
-
-    port = mkOption {
-      type = types.port;
-      default = 8085; # 8080 is taken by aria on jupiter
-      description = "Port Miniflux listens on.";
-    };
-
-    rsshubSecretFile = mkOption {
-      type = types.path;
-      default = "/var/lib/secrets/rsshub.env";
-      description = ''
-        EnvironmentFile holding RSSHub's X session, in the form
-
-        ```
-        TWITTER_AUTH_TOKEN=<auth_token cookie>,<optional second cookie>
-        ```
-
-        X removed guest access, so the bridge needs a logged-in session: copy
-        the `auth_token` cookie from a burner account and close the tab without
-        logging out, since logging out invalidates it. Listing several cookies
-        gives RSSHub rotation headroom when one gets suspended.
-
-        Create this file by hand, root-owned and chmod 600 — it must not end up
-        in the Nix store.
-      '';
-    };
-
-    minifluxSecretFile = mkOption {
-      type = types.path;
-      default = "/var/lib/secrets/miniflux.env";
-      description = ''
-        EnvironmentFile holding the Miniflux admin account:
-
-        ```
-        ADMIN_USERNAME=finn
-        ADMIN_PASSWORD=<at least 6 characters>
-        ```
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Turns X accounts, lists and keyword searches into RSS. Feed URLs look
-    # like http://127.0.0.1:1200/twitter/user/<handle>, /twitter/list/<id> or
-    # /twitter/keyword/<query>.
-    services.rsshub = {
-      enable = true;
-      redis.enable = true;
-      secretFiles = [ cfg.rsshubSecretFile ];
-      settings = {
-        PORT = rsshubPort;
-        LISTEN_INADDR_ANY = false;
-        # X throttles aggressively and answers with an empty 200 rather than an
-        # error, so cache for an hour and keep retries low.
-        CACHE_EXPIRE = "3600";
-        REQUEST_RETRY = "3";
-      };
-    };
-
-    services.miniflux = {
-      enable = true;
-      adminCredentialsFile = cfg.minifluxSecretFile;
-      config = {
-        LISTEN_ADDR = "0.0.0.0:${toString cfg.port}";
-        BASE_URL = "http://${hostName}:${toString cfg.port}/";
-        CREATE_ADMIN = 1;
-        # Minutes. Matched to RSSHub's cache; polling harder just burns the
-        # X session for nothing.
-        POLLING_FREQUENCY = 60;
-      };
-    };
-
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
-    my.homepage.services = [
-      {
-        group = "Services";
-        name = "Miniflux";
-        description = "RSS reader";
-        href = "http://${hostName}:${toString cfg.port}";
-        icon = "miniflux.png";
-      }
-    ];
-  };
-}