From 44d15185db89c5c475f0dce5ecb9a7869e4d1e30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20Schr=C3=B6ter?= <dev@felschr.com>
Date: Sun, 4 Sep 2022 11:23:15 +0200
Subject: [PATCH] fix(calibre-web): secure /opds

---
 secrets/calibre-web/htpasswd.age | Bin 0 -> 526 bytes
 secrets/secrets.nix              |   1 +
 services/calibre-web.nix         |  21 ++++++++++++++++-----
 3 files changed, 17 insertions(+), 5 deletions(-)
 create mode 100644 secrets/calibre-web/htpasswd.age

diff --git a/secrets/calibre-web/htpasswd.age b/secrets/calibre-web/htpasswd.age
new file mode 100644
index 0000000000000000000000000000000000000000..19f7437aff82e086a79eb650dab6edac0c727dc8
GIT binary patch
literal 526
zcmZ9_J&V&|003Y=KqQ-!2ZCnu&|Xa1Bu#G-(zi*|G-*t|v}u;RG)a@@`?F~>c_0cp
z+ztK#7r{wza1s~6>2y495Cm~>P*B$c5!ZYEz@yt1VueOp#rZM{??kDMu9^^X7tS&V
zvCI}pHn(Ak)?|l<?dc@pscZ+-ZC%ObJ|<UK?U89tgSpxd!dm0Ard^a`$Uya2>?m5{
z&KnW4Ud!g9QiFPm4%a{py|}hA!cK@$+(G@>+0EzmVMxO|>TM4+AS%7_a14afor+Y~
z2`tb}5@E552!(a&Vp>#q1_3n6ng%f{eJ^HHzlSN*G6+>kO1)Xv6IvE$a3dwh=aP7K
zqgqRsD&aX(?9`H@yR*5U15ubTP4}MCaw4|j4H6D?N1=$D*kT++5ZTE66(^X>1jMFf
z;CX~=Sk>pj!tKyx#dh43$jXQdT<rhmY|6!MyMfrLrDqnb2ITIR0rz4^7^;J;?e>_8
zC9xG|tqBG~5Ck?V3>|aoU>)AC;&#W)LCh7{47Yi8YO}J6l`Fw;6=Rao(DC8P;`)n2
z{^N&a<Mc1`;3x#IZ@&9-aAJPD`t|L3@!;2whZjHHfcBo9cK5G6zM%bnB40WBy!UGV
Z^0}=yKX3inIHoSWXTLuhK7IN8_CGsqxDNmT

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 1c34c5a..63c1fbe 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -25,6 +25,7 @@ in {
   "owntracks/recorder.env.age".publicKeys = [ felschr home-pc home-server ];
   "owntracks/htpasswd.age".publicKeys = [ felschr home-pc home-server ];
   "etebase-server.age".publicKeys = [ felschr home-pc home-server ];
+  "calibre-web/htpasswd.age".publicKeys = [ felschr home-pc home-server ];
   "miniflux.age".publicKeys = [ felschr home-pc home-server ];
   "paperless.age".publicKeys = [ felschr home-pc home-server ];
   "nextcloud/admin.age".publicKeys = [ felschr home-pc home-server ];
diff --git a/services/calibre-web.nix b/services/calibre-web.nix
index 275a651..f4371ab 100644
--- a/services/calibre-web.nix
+++ b/services/calibre-web.nix
@@ -2,6 +2,11 @@
 
 let port = 8088;
 in {
+  age.secrets.calibre-web-htpasswd = {
+    file = ../secrets/calibre-web/htpasswd.age;
+    owner = config.services.nginx.user;
+  };
+
   services.calibre-web = {
     enable = true;
     group = "media";
@@ -16,11 +21,17 @@ in {
     virtualHosts."books.felschr.com" = {
       enableACME = true;
       forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://[::1]:${toString port}";
-        extraConfig = ''
-          client_max_body_size 500M;
-        '';
+      locations = {
+        "/" = {
+          proxyPass = "http://[::1]:${toString port}";
+          extraConfig = ''
+            client_max_body_size 500M;
+          '';
+        };
+        "/opds" = {
+          proxyPass = "http://[::1]:${toString port}";
+          basicAuthFile = config.age.secrets.calibre-web-htpasswd.path;
+        };
       };
     };
   };