feat: plausible

hosts/picard/default.nix

@@ -10,6 +10,7 @@
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
       ./xynospace-matrix.nix
+      ./plausible.nix
     ];
 
   documentation.enable = false;
@@ -51,6 +52,8 @@
     enableACME = true;
     forceSSL = true;
     locations."/".proxyPass = "http://[::1]${config.services.xynoblog.listen}";
+    locations."/js".proxyPass = "http://127.0.0.1:${toString config.services.plausible.server.port}";
+    locations."/api/event".proxyPass = "http://127.0.0.1:${toString config.services.plausible.server.port}";
   };
   services.lolpizza2.enable = true;
   services.nginx.virtualHosts."lolpizza.ragon.xyz" = {

hosts/picard/plausible.nix

@@ -0,0 +1,34 @@
+{ config, lib, pkgs, ... }:
+let domain = "stats.xyno.space";
+in {
+  ragon.agenix.secrets."plausibleAdminPw" = { };
+  ragon.agenix.secrets."plausibleReleaseCookie" = { };
+  ragon.agenix.secrets."plausibleSecretKeybase" = { };
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/".proxyPass =
+      "http://127.0.0.1:${toString config.services.plausible.server.port}";
+  };
+  services.plausible = {
+    enable = true;
+    releaseCookiePath = config.age.secrets.plausibleSecretKeybase.path;
+
+    adminUser = {
+      # activate is used to skip the email verification of the admin-user that's
+      # automatically created by plausible. This is only supported if
+      # postgresql is configured by the module. This is done by default, but
+      # can be turned off with services.plausible.database.postgres.setup.
+      activate = true;
+      email = "john.doe@example.com";
+      passwordFile = config.age.secrets.plausibleAdminPw.path;
+    };
+
+    server = {
+      baseUrl = "https://${domain}";
+      secretKeybaseFile = config.age.secrets.plausibleSecretKeybase.path;
+    };
+  };
+
+  ragon.persist.extraDirectories = [ "/var/lib/private/plausible" ];
+}

secrets/plausibleReleaseCookie.age

@@ -0,0 +1,18 @@
+age-encryption.org/v1
+-> ssh-ed25519 WceKOQ s6LEhBv5f0Y4pFAiqT5sAiz5MQcCEXzzAvRn60nY91o
+azm/SHN8np8/VggbvfgvR8GUWev7NMYPFjKEAojBDGM
+-> ssh-ed25519 ugHWWw 1clL4KDUfDvGxvbC5IOjT8NYaGWF+UptCrbmOuEcuW4
+KAjVBXJa080+2XwAwrddL939dHC5ca0mR291k5/uuaU
+-> ssh-ed25519 UU9RSA Fva5zn/dOj0wEPxIJGnd4d/artjrsO9IEQMYM103x3A
+Kn++cAaHqtw6HaHiY66XTc2+P+mxtOEH1EZp94MXjcw
+-> ssh-ed25519 RJI3BA 7pnamgoI9/0Km2LDVF3THQi7CRNxkYmz8wL96/aoGys
+sXM6LAz84SfAh9tLkUK25++Qdz/qGk6V7rdvqkmXwg4
+-> ssh-ed25519 XnvJKw rUUAhwaXS9wcDt3buIgsfaKadiV9SKvpw8e5JVsTEnk
+dO16Um3KgYBBJ63dGmPUAO7Z899iOwyyU4f5QSEYr+A
+-> ssh-ed25519 7NL5Ng HNd75fgH8IxECxfCMvf45YY3qF5OjGVDeJSARYddMiM
+h3zcp4pe/x/PMOiAr7XV2Ow1Zz78WaSNJNM56CdJ6Bc
+-> S92&V-grease
+PzsnXw7IaNSZQ1Uf104RzTYwrdN+mqO7Lr9n5X2OJzVz0vgJLhfGOBIKULn90qo9
+26q9XH7QFw
+--- OKB5WPytBPOgAexxmQnQB6O0BnQr6X9tErM6gyKr0O0
+gíHœ£EƒpÒÀ²Å3}z#Sɺ¤xÐìønCU"=<3D>«§ŒÐÄ>Γ³=Òw°ÙT=x
íäÏÀÍâÃrýè.ñ&~2"g<>ÁW<13>ÃdÆ˼W„؈Ž #ØÄ¥…\Äœ÷XüFÊ8'8Y[J1Íp½»5mm

secrets/plausibleSecretKeybase.age

@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-ed25519 WceKOQ rCdPywD1r/PHf48nPrY6HPUT1LxQ6MBrJKLCurgju0s
+kGnFV/KXM50y9QKwRK/IZIuqQ13QouziqMyiZ2PXO1U
+-> ssh-ed25519 ugHWWw 7KkMzqW7p+tOXkvC0ho6BSvlMXBWY/SQNN8D50KhTzM
+6yb/srww8wgqew6nKTPqTgSsMriC2oU8I92kjPdFvqU
+-> ssh-ed25519 UU9RSA jMFgLgwjJHjAgGVcOzIQFc5IdohxZ+AXp0r5kppJgBY
+Q3KDHtaa40kZqjZfhU7TL7udeEVa69m/o+HmKWibZiA
+-> ssh-ed25519 RJI3BA 0jX5SqapLzsryxeOiq3T+3K/GYsEH/gQ7bWKP9yqpl0
+SluEKtJOMPMUt6nwie/44LoJY7+IkSQ9cqaT+pIR5/4
+-> ssh-ed25519 XnvJKw joxQfynNc+2p6ETEy9CWUCktVgAPH7E9pubD5kG1u3k
+5/2eYHgb5NGN19gH9DvkDNPLyhDuoCYJAAIl7x8urHg
+-> ssh-ed25519 7NL5Ng JeTzth65EzZWOjHHbo+8eg0ui6pQ3vjnEy3z7nR0Z1Q
+Rh2tGhS8HSMKBFVuV8oXNK0ftM0M+VPdkSN+zxd/W5Q
+-> gq{Jn]M-grease y 9<x#3\
+qJ+LuOhrIcSjstMFImU5dBd+lMwKOxEBQef3QwP9r2GwlmZQX47Szuopn8bfFu7O
+KA0z9/wxE4MyKpXB+HWvAFKECN9lqiE
+--- rfodJC9btD84cYAw78svetJaLNK1R/EXeZvssycXV+g
+ÅEd"CŒ¾Ïï’>Ý&yãÐŒà¢ÙùÔÙoŠ¯9A.;Ê–èØÔ¥<C394>‡ÆÄæ5è8™•âIË.Æ°µÉ<C2B5>B˜©¬S=×n@,¼:I1æ•
+WL¢uQÁnД¶—–RV8
R-“‹ä5äiè¢6ªß–°#

secrets/secrets.nix

@@ -17,6 +17,9 @@ in
   "ds9OffsiteBackupSSH.age".publicKeys = pubkeys.ragon.host "ds9";
   "ds9SyncoidHealthCheckUrl.age".publicKeys = pubkeys.ragon.host "ds9";
   "gatebridgeHostKeys.age".publicKeys = pubkeys.ragon.host "ds9";
+  "plausibleAdminPw.age".publicKeys = pubkeys.ragon.host "picard";
+  "plausibleReleaseCookie.age".publicKeys = pubkeys.ragon.host "picard";
+  "plausibleSecretKeybase.age".publicKeys = pubkeys.ragon.host "picard";
   "hedgedocSecret.age".publicKeys = pubkeys.ragon.host "picard";
   "mailmoverConf.age".publicKeys = pubkeys.ragon.host "picard";
   "matrixSecrets.age".publicKeys = pubkeys.ragon.host "picard";