feat(nixnuc): migrate from Wallabag to Karakeep

[genebean]

Goal

Replace Wallabag (Docker Compose + MariaDB) with Karakeep as a NixOS-native service.

What's been done

• Wrote modules/hosts/nixos/nixnuc/karakeep.nix — native NixOS service via services.karakeep
• Added port 3003 for karakeep in ports.nix
• Added nginx vhost for karakeep.home.technicalissues.us in default.nix
• Added karakeep_env sops secret wiring in default.nix
• Wrote migration script at ~/repos/wallabag-to-karakeep/migrate.py

Configuration: Meilisearch (search), Chromium (screenshots), OpenAI API (AI tagging), Pocket ID (OIDC auth). No Ollama, no Redis.

Branch: karakeep

Remaining steps

Before applying

• Register Karakeep as an OIDC app in Pocket ID
  • Redirect URL: https://karakeep.home.technicalissues.us/api/auth/callback/custom
• Add karakeep_env sops secret to secrets.yaml with:
  • OAUTH_CLIENT_ID (from Pocket ID)
  • OAUTH_CLIENT_SECRET (from Pocket ID)
  • OPENAI_API_KEY
  • Note: NEXTAUTH_SECRET and MEILI_MASTER_KEY are auto-generated on first run
• sudo nixos-rebuild switch --flake .

After Karakeep is running

• Generate a Karakeep API key (Settings → API Keys)
• Temporarily expose MariaDB in the wallabag compose file (ports: ["3316:3306"])
• Run ~/repos/wallabag-to-karakeep/migrate.py to import 542 entries
• Remove temporary MariaDB port mapping
• Verify data in Karakeep
• Stop and remove Wallabag compose stack and clean up ~/compose-files/wallabag/