ymrtech/nix-config
1
0
Fork 0
Code Issues 6 Pull requests 2 Projects Releases Packages Activity Actions

feat(public): add Kanboard kanban board for nix-config #27

Open
ymrtech wants to merge 11 commits from feat/kanboard-board into main
pull from: feat/kanboard-board
merge into: ymrtech:main
Conversation 0 Commits 11 Files changed 2 +57 -8
ymrtech commented 2026-08-01 18:17:44 -06:00
Owner
Copy link

Summary

Add Kanboard (MIT licensed) self-hosted kanban board for managing the nix-config project backlog and workflow, accessible at https://board.ymrtech.com.

Changes

Kanboard service (services.kanboard)

  • Enable kanboard package
  • PostgreSQL backend (uses existing PostgreSQL instance on the public host)
  • Creates kanboard database and user via ensureDatabases/ensureUsers
  • Configures URL base to https://board.ymrtech.com
  • Password stored in SOPS secret (kanboard-db-pass)

Caddy reverse proxy

  • ACME TLS cert for board.ymrtech.com (webroot on /var/lib/caddy/.well-known)
  • Reverse proxy to localhost:7777 (kanboard's default port)
  • Standard security headers matching other services (HSTS, CSP, etc.)
  • JSON logging to /var/log/caddy/board-access.log

Database

  • PostgreSQL already enabled on this host; added kanboard database and user
  • Initial database setup runs via ensureDatabases/ensureUsers during NixOS activation

Prerequisites

  • Add a SOPS secret kanboard-db-pass before first deploy: 
    echo -n "your-password-here" | sops --encrypt --in-place secrets/secrets.yaml
  • Ensure DNS board.ymrtech.com points to this host's IP (10.0.0.220)

Deployment

After merging, the first nixos-rebuild switch will:

  1. Create the kanboard PostgreSQL database and user
  2. Start kanboard on port 7777
  3. Caddy will serve HTTPS via the ACME cert for board.ymrtech.com

The first visit to https://board.ymrtech.com will show the kanboard setup wizard (admin user creation).

## Summary Add [Kanboard](https://kanboard.org/) (MIT licensed) self-hosted kanban board for managing the nix-config project backlog and workflow, accessible at `https://board.ymrtech.com`. ## Changes ### Kanboard service (`services.kanboard`) - Enable kanboard package - PostgreSQL backend (uses existing PostgreSQL instance on the public host) - Creates `kanboard` database and user via `ensureDatabases`/`ensureUsers` - Configures URL base to `https://board.ymrtech.com` - Password stored in SOPS secret (`kanboard-db-pass`) ### Caddy reverse proxy - ACME TLS cert for `board.ymrtech.com` (webroot on `/var/lib/caddy/.well-known`) - Reverse proxy to `localhost:7777` (kanboard's default port) - Standard security headers matching other services (HSTS, CSP, etc.) - JSON logging to `/var/log/caddy/board-access.log` ### Database - PostgreSQL already enabled on this host; added `kanboard` database and user - Initial database setup runs via `ensureDatabases`/`ensureUsers` during NixOS activation ## Prerequisites - Add a SOPS secret `kanboard-db-pass` before first deploy: ```bash echo -n "your-password-here" | sops --encrypt --in-place secrets/secrets.yaml ``` - Ensure DNS `board.ymrtech.com` points to this host's IP (10.0.0.220) ## Deployment After merging, the first `nixos-rebuild switch` will: 1. Create the kanboard PostgreSQL database and user 2. Start kanboard on port 7777 3. Caddy will serve HTTPS via the ACME cert for `board.ymrtech.com` The first visit to `https://board.ymrtech.com` will show the kanboard setup wizard (admin user creation).
- Enable kanboard service with PostgreSQL backend
- Create kanboard database and user in PostgreSQL
- Add ACME cert for board.ymrtech.com using listenHTTP (port :80)
- Add caddy reverse proxy for board.ymrtech.com -> localhost:7777
- Add kanboard-db-pass SOPS secret
- Use DB_DRIVER, DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, DB_NAME, DB_PORT
- Use APPLICATION_URL instead of url.base
- Use DB_PASSWORD with sops secret value instead of passwordFile
- DB_DRIVER, DB_HOSTNAME, DB_NAME, DB_USERNAME, DB_PASSWORD
- DB_PORT removed (5432 is default for postgres)
- APPLICATION_URL instead of url.base
- DB_PASSWORD uses sops secret .value instead of .path
This pull request has changes conflicting with the target branch.
  • hosts/public/default.nix
  • secrets/secrets.yaml
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/kanboard-board:feat/kanboard-board
git switch feat/kanboard-board

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff feat/kanboard-board
git switch feat/kanboard-board
git rebase main
git switch main
git merge --ff-only feat/kanboard-board
git switch feat/kanboard-board
git rebase main
git switch main
git merge --no-ff feat/kanboard-board
git switch main
git merge --squash feat/kanboard-board
git switch main
git merge --ff-only feat/kanboard-board
git switch main
git merge feat/kanboard-board
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog

   
bug

   
enhancement

   
in-progress

   
review

   
todo
No labels
backlog
bug
enhancement
in-progress
review
todo
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
ymrtech/nix-config!27
No description provided.