rework pocket-id to be more generic

machines/b4l/services/pocket-id.nix

@@ -0,0 +1,35 @@
+{ config, ... }:
+let
+  pidDomain = "${config.clan.core.vars.generators.b4l-pocket-id.files.subdomain.value}.${config.networking.fqdn}";
+in
+{
+  clan.core.vars.generators.b4l-pocket-id = {
+    files.subdomain.secret = false;
+
+    prompts = {
+      subdomain = {
+        persist = true;
+        type = "line";
+        description = "Sub-domain for Pocket-ID app. Default:(auth)";
+      };
+    };
+
+    script = ''cat $prompts/subdomain || echo -n "auth" > $out/subdomain'';
+  };
+
+  services.pocket-id = {
+    settings = {
+      APP_ENV = "production";
+      APP_URL = "https://${pidDomain}";
+      TRUST_PROXY = true;
+    };
+  };
+
+  services.nginx.virtualHosts."${pidDomain}" = {
+    useACMEHost = "${config.networking.fqdn}";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.pocket-id.settings.PORT}";
+    };
+  };
+}