vps1: add outline service

hosts/vps1/default.nix

@@ -2,6 +2,7 @@
   config,
   pkgs,
   lib,
+  self,
   ...
 }:
 
@@ -11,7 +12,10 @@
     ../server.nix
   ];
 
-  nixpkgs.hostPlatform = "x86_64-linux";
+  nixpkgs = {
+    hostPlatform = "x86_64-linux";
+    config.allowUnfree = true;
+  };
 
   networking = {
     hostId = "08bf6db3";
@@ -86,6 +90,45 @@
         proxyPass = "https://127.0.0.1:3013";
       };
     };
+    "outline.vimium.com" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:3000";
+        extraConfig = ''
+          proxy_set_header Upgrade $http_upgrade;
+          proxy_set_header Connection "Upgrade";
+          proxy_set_header Host $host;
+
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Scheme $scheme;
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_redirect off;
+        '';
+      };
+    };
+  };
+
+  age.secrets."passwords/services/outline/oidc-client-secret" = {
+    file = "${self.inputs.secrets}/passwords/services/outline/oidc-client-secret.age";
+    owner = "outline";
+    group = "outline";
+  };
+
+  services.outline = {
+    enable = true;
+    forceHttps = false;
+    oidcAuthentication = {
+      clientId = "outline";
+      clientSecretFile = config.age.secrets."passwords/services/outline/oidc-client-secret".path;
+      displayName = "Vimium";
+      authUrl = "https://auth.vimium.com/ui/oauth2";
+      tokenUrl = "https://auth.vimium.com/oauth2/token";
+      userinfoUrl = "https://auth.vimium.com/oauth2/openid/outline/userinfo";
+    };
+    publicUrl = "https://outline.vimium.com";
+    storage.storageType = "local";
   };
 
   modules = rec {