From e41f869843f3234b7870b30d2a56b30cb8337ac0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 17:44:04 -0400
Subject: [PATCH] trilium: add self-hosted note-taking service

Add trilium-server on port 8787 behind Caddy reverse proxy at
notes.sigkill.computer. Data stored on ZFS tank pool with
serviceMountWithZpool for mount ordering.
---
 configuration.nix    |  1 +
 service-configs.nix  |  8 ++++++++
 services/trilium.nix | 26 ++++++++++++++++++++++++++
 3 files changed, 35 insertions(+)
 create mode 100644 services/trilium.nix

diff --git a/configuration.nix b/configuration.nix
index de8f0b3..2099a6b 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -49,6 +49,7 @@
 
     ./services/llama-cpp.nix
     ./services/llama-cpp-annotations.nix
+    ./services/trilium.nix
 
     ./services/ups.nix
     ./services/monitoring.nix
diff --git a/service-configs.nix b/service-configs.nix
index 8f68293..78cd711 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -173,6 +173,10 @@ rec {
         port = 6688;
         proto = "tcp";
       };
+      trilium = {
+        port = 8787;
+        proto = "tcp";
+      };
     };
   };
 
@@ -302,6 +306,10 @@ rec {
     domain = "grafana.${https.domain}";
   };
 
+  trilium = {
+    dataDir = services_dir + "/trilium";
+  };
+
   media = {
     moviesDir = torrents_path + "/media/movies";
     tvDir = torrents_path + "/media/tv";
diff --git a/services/trilium.nix b/services/trilium.nix
new file mode 100644
index 0000000..758154a
--- /dev/null
+++ b/services/trilium.nix
@@ -0,0 +1,26 @@
+{
+  config,
+  pkgs,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "trilium-server" service_configs.zpool_ssds [
+      (service_configs.services_dir + "/trilium")
+    ])
+  ];
+
+  services.trilium-server = {
+    enable = true;
+    port = service_configs.ports.private.trilium.port;
+    host = "127.0.0.1";
+    dataDir = service_configs.trilium.dataDir;
+  };
+
+  services.caddy.virtualHosts."notes.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${toString service_configs.ports.private.trilium.port}
+  '';
+}