Install microboard in docker

nixos/configuration.nix

@@ -20,6 +20,7 @@
     ./programs/maddy.nix
     ./programs/plausible.nix
     ./programs/clickhouse.nix
+    ./programs/docker.nix
     ./programs/microboard.nix
   ];
 

nixos/programs/docker.nix

@@ -0,0 +1,12 @@
+{ config, ... }:
+{
+  virtualisation.docker = {
+    enable = true;
+    storageDriver = "btrfs";
+    autoPrune.enable = true;
+    rootless = {
+      enable = true;
+      setSocketVariable = true;
+    };
+  };
+}

nixos/programs/microboard.nix

@@ -3,34 +3,15 @@ let
   dataDir = "/var/lib/microboard";
 in
 {
-  systemd.services.microboard = {
-    description = "Microboard engine";
-    wantedBy = ["multi-user.target"];
-
-    environment = {
-      MB_LOGLEVEL = "warning";
-      MB_UPLOADDIR = "${ dataDir }/uploads";
-      MB_PREVIEWDIR = "${ dataDir }/previews";
-      MB_DBHOST = "/run/postgresql";
-      MB_DBUSER = "microboard";
-      MB_DBNAME = "microboard";
-    };
-
-    serviceConfig = {
-      User = "microboard";
-      Group = "microboard";
-      ExecStart = "${ dataDir }/microboard";
-      Restart = "on-failure";
-      Type = "exec";
-      WorkingDirectory = dataDir;
-
-      # Security Hardening
-      LockPersonality = true;
-      NoNewPrivileges = true;
-      ProtectSystem = "strict";
-      ReadWritePaths = [ dataDir ];
-      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
-      RestrictSUIDSGID = true;
-    };
+  virtualisation.oci-containers.containers.microboard = {
+    autoStart = true;
+    image = "ghcr.io/ordinary-dev/microboard:v0.0.4";
+    environmentFiles = "/var/lib/microboard/.env";
+    ports = ["55006:8080"];
+    user = "microboard:microboard";
+    volumes = [
+      "/var/lib/microboard:/app"
+      "/run/postgresql:/run/postgresql"
+    ];
   };
 }

nixos/programs/nginx.nix

@@ -68,6 +68,17 @@ in {
           };
         };
       };
+      
+      # Microboard
+      "0ch.space" = {
+        useACMEHost = "0ch.space";
+        forceSSL = true;
+        locations = {
+          "/" = {
+            proxyPass = "http://127.0.0.1:55006";
+          };
+        };
+      };
 
       # Mail: MTA-STS
       "mta-sts.comfycamp.space" = {