host(koumakan): add pixivfe

Author: soopyc

creds/sops/koumakan/default.yaml

@@ -58,6 +58,8 @@ pds:
     email:
         address: ENC[AES256_GCM,data:4GAp7aW4JtTlfKc7bohYRyY+6KeJjAXJW/R6lpF22qMEbOTNZA==,iv:GG9N8u6Tlse+rVTQ4Na3KhA85stsFSF874/5/TKlw38=,tag:NfW/5VqIX5raz411Jji6rQ==,type:str]
         url: ENC[AES256_GCM,data:wXRXEjrLeCVyrsTWfAHw0D95byOWHABU6SvIHguiOUW7r1fljAt8f0QkaSaaIg1AUN0jeSYESkoQG9yk8cxL7/vqLwK421j+Q/LZsWATbpLtkSHHdzX6YQUDw77MXqGON88YkTpk3Ur6P/ereQz2iBP9Ph8=,iv:nwED4OY1R3VWSjgNy79FbiuNQ5qKgOX3YPHhZJKTf9A=,tag:fVJtQwAr9rEtDcREXVqgwg==,type:str]
+pixivfe:
+    token: ENC[AES256_GCM,data:N90DOJ0mip8FuuQD2iHA2OMDIePuM6tddLRLCjgNXpnp4PnRBFgt7UOvY/163DYphRtI/dl6Dl2odlpJ7UDtqYUKmNVtzGUGHLz38XQMCXN4rXnCXQ==,iv:3w5L2p+yQvKxusT3LBG/YXwQMrYhz+km1RuWmr4ZeO8=,tag:YHAHqrgqzq3K0x3XcNizwg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -91,8 +93,8 @@ sops:
             QUlVNExmVGd2QXJwVmRGa0JvMmtocEUK7Zo0Mtj3oZm5Etp61cGbLs+2XP97pjR6
             rtfHnuxceJj0+yBugfwgFD1TGJ+6M7z5YCwTx+GAvbPDrmSm2TGrwg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-20T13:09:05Z"
-    mac: ENC[AES256_GCM,data:KLI27LDfb3WElcYo+/MJwgWsJQ+WBynBFp+dZgwIr0+QyMPQ4Qax03AhWqYrCqJZxKzlmOzyYOwBaf6XJ2yuvKZIDD0tS6ok91+/5XSpGhMCjYhbaM2FSBtPHg+sQDunYg+MchcLj1L95vdPm4EmwJ5cQrWi7szDOl30XTgR5rw=,iv:5AWmzR/DutmW/HuyPqYN6aO/+7OlcNAaSXt4jNIoYpw=,tag:K1p2FSM3qhFMeIN0bxVv1A==,type:str]
+    lastmodified: "2025-02-04T14:53:56Z"
+    mac: ENC[AES256_GCM,data:1RhaDTblBs6s7xavwatyQlP3sHBRqDaH99MCaFcIk2hUxb7iFE7FwqLa7KlSSXJ7wWUQpiCdovLewn2jRQKt3Jz2vtA1++6n6AedeDlZin/CRbQLWSVRzN6DF/m5qvF8pKI88/bQR50DH4B5wTGPnmrImznWh5DQk5Lo3SGfnCk=,iv:Dp7CaZmoQSxORxtUAMOPD99M33fZz5e3HVxVpCEqeto=,tag:gcLA0Vkh0r3GWBcI76Y+oQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.9.4

systems/koumakan/services/arion/default.nix

@@ -1,6 +1,7 @@
 {...}: {
   imports = [
     ./breezewiki.nix
+    ./pixivfe.nix
   ];
 
   virtualisation.arion.backend = "podman-socket";

systems/koumakan/services/arion/pixivfe.nix

@@ -0,0 +1,73 @@
+{
+  _utils,
+  config,
+  lib,
+  ...
+}: let
+  secrets = _utils.setupSecrets config {
+    namespace = "pixivfe";
+    secrets = ["token"];
+  };
+in {
+  imports = [
+    secrets.generate
+    (secrets.mkTemplate "pixivfe.env" ''
+      PIXIVFE_TOKEN=${secrets.placeholder "token"}
+    '')
+  ];
+
+  virtualisation.arion.projects.pixivfe.settings = {
+    services.pixivfe.service = {
+      image = "vnpower/pixivfe:latest";
+      ports = [
+        "127.0.0.1:35284:8282"
+      ];
+      capabilities = {
+        ALL = false; # drop all capabilities
+      };
+      environment = {
+        PIXIVFE_PORT = 8282;
+        PIXIVFE_HOST = "0.0.0.0";
+        PIXIVFE_IMAGEPROXY = "https://pximg.soopy.moe";
+        PIXIVFE_CACHE_ENABLED = "true";
+      };
+      env_file = lib.singleton (secrets.getTemplate "pixivfe.env");
+    };
+  };
+
+  services.nginx = {
+    # cash money
+    proxyCachePath."pximg" = {
+      enable = true;
+      maxSize = "10g";
+      inactive = "30d";
+      keysZoneName = "pximg";
+    };
+
+    virtualHosts."pximg.soopy.moe" = {
+      locations."/" = {
+        recommendedProxySettings = false;
+        proxyPass = "https://i.pximg.net";
+        extraConfig = ''
+          # bypass
+          proxy_set_header Host i.pximg.net;
+          proxy_set_header Referer "https://www.pixiv.net/";
+          proxy_set_header User-Agent "Mozilla/5.0 (Windows NT 10.0; rv:133.0) Gecko/20100101 Firefox/133.0";
+          add_header x-cache-status $upstream_cache_status;
+
+          # cache config
+          proxy_cache pximg;
+          proxy_cache_lock on;
+          proxy_cache_valid 200 30d;
+          proxy_cache_valid 404 5m;
+          proxy_cache_revalidate on;
+          proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+        '';
+      };
+    };
+
+    virtualHosts."pxv.soopy.moe" = _utils.mkSimpleProxy {
+      port = 35284;
+    };
+  };
+}