First commit

.gitignore

@@ -0,0 +1 @@
+flake.lock

README.org

@@ -0,0 +1 @@
+* MariaDB flake service example

flake.nix

@@ -0,0 +1,70 @@
+{
+  description = "MariaDB flake usage example";
+
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-25.11";
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    mariadb-server = {
+      url = "./services/mariadb/";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = {
+    self, nixpkgs, sops-nix, mariadb-server, ...
+  }: {
+    # Re-export individual modules
+    nixosModules = {
+      mariadb = mariadb-server.nixosModules.mariadb;
+    };
+
+    # Convenience module: imports all service modules + sets default config
+    nixosModules.ogc = {config, lib, ...}:
+    let
+      cfg = config.ogc;
+    in {
+      imports = [
+        mariadb-server.nixosModules.mariadb
+        sops-nix.nixosModules.sops
+      ];
+
+      options.ogc = {
+        organization = lib.mkOption {
+          type = lib.types.str;
+        };
+        extension = lib.mkOption {
+          type = lib.types.str;
+        };
+        domain = lib.mkOption {
+          type = lib.types.str;
+        };
+      };
+
+      config = {
+        sops = {
+          defaultSopsFile = ./secrets/ogc.yaml;
+          # This will automatically import SSH keys as age keys
+          age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+          # This is using an age key that is expected to already be in the filesystem
+          age.keyFile = "~/.config/sops/age/keys.txt";
+          # This will generate a new key if the key specified above does not exist
+          age.generateKey = true;
+          secrets."mariadb/root" = {};
+          secrets."mariadb/nextcloud" = {};
+        };
+
+        # MariaDB
+        mariadb = {
+          enable = lib.mkDefault true;
+          rootPasswordFile = lib.mkDefault "/run/secrets/mariadb/root";
+          nextcloudPasswordFile = lib.mkDefault "/run/secrets/mariadb/nextcloud";
+        };
+      };
+    };
+
+    nixosModules.default = self.nixosModules.ogc;
+  };
+}

mariadb/flake.nix

@@ -0,0 +1,64 @@
+{
+  description = "NixOS MariaDB server";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+  };
+
+  outputs = { self, nixpkgs, ... }: {
+
+    nixosModules.mariadb = { config, lib, pkgs, ... }:
+      let
+        cfg = config.mariadb;
+      in
+      {
+        options.mariadb = {
+          enable = lib.mkOption {
+            type = lib.types.bool;
+          };
+          rootPasswordFile = lib.mkOption {
+            type = lib.types.path;
+            description = "Path to file containing the root password.";
+          };
+          nextcloudPasswordFile = lib.mkOption {
+            type = lib.types.path;
+            description = "Path to file containing the nextcloud user password.";
+          };
+        };
+
+        config = lib.mkIf cfg.enable {
+          services.mysql = {
+            #enable = true;
+            enable = false;
+            package = pkgs.mariadb;
+            #ensureDatabases = [ "nextcloud" ];
+            #ensureUsers = [
+            #  {
+            #    name = "nextcloud";
+            #    ensurePermissions = { "nextcloud.*" = "ALL PRIVILEGES"; };
+            #  }
+            # ];
+          };
+
+          # systemd script to set up users passwords
+#           systemd.services.mariadb-set-nextcloud-password = {
+#             description = "Set MariaDB user passwords from file";
+#             after = [ "mysql.service" ];
+#             requires = [ "mysql.service" ];
+#             wantedBy = [ "multi-user.target" ];
+#             serviceConfig = {
+#               Type = "oneshot";
+#               RemainAfterExit = true;
+#             };
+#             script = ''
+#               set -euo pipefail
+#               echo "Setting nextcloud user password..."
+#               PASSWORD=$(cat "${cfg.nextcloudPasswordFile}")
+#               ${pkgs.mariadb}/bin/mysql -u root -p"$(cat ${cfg.rootPasswordFile})" -e "ALTER USER 'nextcloud'@'localhost' IDENTIFIED BY '$PASSWORD';"
+#               echo "Nextcloud user password set."
+#             '';
+#           };
+        };
+      };
+  };
+}