From 256e143ffc51686bc5b94207127b5cbeb796d793 Mon Sep 17 00:00:00 2001
From: Will Holdsworth <me@fi33.buzz>
Date: Sat, 7 Mar 2026 16:42:57 +1100
Subject: [PATCH] feat(mealie): install

---
 modules/nixos/bundles/server.nix  |  1 +
 modules/nixos/features/mealie.nix | 56 +++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 modules/nixos/features/mealie.nix

diff --git a/modules/nixos/bundles/server.nix b/modules/nixos/bundles/server.nix
index 0cbc9e9..1aa12e4 100644
--- a/modules/nixos/bundles/server.nix
+++ b/modules/nixos/bundles/server.nix
@@ -18,6 +18,7 @@
     "kavita"
     "libretranslate"
     "lidarr"
+    "mealie"
     "miniflux"
     "ntfy-sh"
     "nzbget"
diff --git a/modules/nixos/features/mealie.nix b/modules/nixos/features/mealie.nix
new file mode 100644
index 0000000..cf86620
--- /dev/null
+++ b/modules/nixos/features/mealie.nix
@@ -0,0 +1,56 @@
+{
+  config,
+  ...
+}:
+let
+  port = 5026;
+  certloc = "/var/lib/acme/fi33.buzz";
+  hostname = "mealie.fi33.buzz";
+  url = "https://${hostname}";
+in
+{
+  services = {
+    mealie = {
+      enable = true;
+      inherit port;
+      settings = {
+        TZ = "Australia/Melbourne";
+        ALLOW_SIGNUP = "false";
+      };
+    };
+
+    gatus.settings.endpoints = [
+      {
+        name = "Private Services";
+        group = "";
+        inherit url;
+        interval = "5m";
+        conditions = [
+          "[STATUS] == 200"
+          "[CONNECTED] == true"
+          "[RESPONSE_TIME] < 500"
+        ];
+        alerts = [ { type = "ntfy"; } ];
+      }
+    ];
+
+    # borgmatic.settings = {
+    #   source_directories = [ ];
+    #   postgresql_databases = [
+    #     {
+    #       name = "mealie";
+    #       hostname = "localhost";
+    #       username = "root";
+    #       password = "{credential systemd borgmatic-pg}";
+    #     }
+    #   ];
+    # };
+
+    caddy.virtualHosts.${hostname}.extraConfig = ''
+      reverse_proxy localhost:${toString port}
+      tls ${certloc}/cert.pem ${certloc}/key.pem {
+        protocols tls1.3
+      }
+    '';
+  };
+}