mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

feat: change forgejo user to git and allow git to login

Browse source
This commit is contained in:
oddlama 2024-03-13 02:08:40 +01:00
parent 65b638443b
commit 1631c116fd
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
2 changed files with 20 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

23
hosts/ward/guests/forgejo.nix
View file

@ -78,14 +78,26 @@ in {
}; };
}; };
# Recommended by forgejo: https://forgejo.org/docs/latest/admin/recommendations/#git-over-ssh users.groups.git = {};
services.openssh.settings.AcceptEnv = "GIT_PROTOCOL"; users.users.git = {
isSystemUser = true;
useDefaultShell = true;
group = "git";
home = config.services.forgejo.stateDir;
};
services.openssh = {
authorizedKeysFiles = lib.mkForce [
"${config.services.forgejo.stateDir}/.ssh/authorized_keys"
];
# Recommended by forgejo: https://forgejo.org/docs/latest/admin/recommendations/#git-over-ssh
settings.AcceptEnv = "GIT_PROTOCOL";
};
environment.persistence."/persist".directories = [ environment.persistence."/persist".directories = [
{ {
directory = config.services.forgejo.stateDir; directory = config.services.forgejo.stateDir;
user = "forgejo"; inherit (config.services.forgejo) user group;
group = "forgejo";
mode = "0700"; mode = "0700";
} }
]; ];
@ -94,6 +106,8 @@ in {
enable = true; enable = true;
# TODO db backups # TODO db backups
# dump.enable = true; # dump.enable = true;
user = "git";
group = "git";
lfs.enable = true; lfs.enable = true;
mailerPasswordFile = config.age.secrets.forgejo-mailer-password.path; mailerPasswordFile = config.age.secrets.forgejo-mailer-password.path;
settings = { settings = {
@ -148,6 +162,7 @@ in {
ROOT_URL = "https://${forgejoDomain}/"; ROOT_URL = "https://${forgejoDomain}/";
LANDING_PAGE = "login"; LANDING_PAGE = "login";
SSH_PORT = 9922; SSH_PORT = 9922;
SSH_USER = "git";
}; };
service = { service = {
DISABLE_REGISTRATION = false; DISABLE_REGISTRATION = false;

2
modules/config/users.nix
View file

@ -23,7 +23,7 @@
influxdb2 = uidGid 986; influxdb2 = uidGid 986;
telegraf = uidGid 985; telegraf = uidGid 985;
rtkit = uidGid 984; rtkit = uidGid 984;
forgejo = uidGid 983; git = uidGid 983;
redis-paperless = uidGid 982; redis-paperless = uidGid 982;
nixseparatedebuginfod = uidGid 981; nixseparatedebuginfod = uidGid 981;
msr = uidGid 980; msr = uidGid 980;