feat: add docuseal

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>

hosts/servers/hosting-01.nix

@@ -153,6 +153,26 @@ in
     };
   };
 
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      docuseal = {
+        image = "docuseal/docuseal:latest";
+        ports = [ "3001:3000" ];
+        environmentFiles = [ config.sops.secrets.docusealEnvironment.path ];
+        extraOptions = [ "--dns=100.100.100.100" ];
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."sign.kinkystar.com" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://localhost:3001";
+    };
+  };
+
   sops = {
     defaultSopsFile = ./hosting-01.yaml;
     validateSopsFiles = false;
@@ -165,6 +185,10 @@ in
       vaultwarden = {
         owner = "root";
       };
+
+      docusealEnvironment = {
+        owner = "root";
+      };
     };
   };