mirror of
https://github.com/oddlama/nix-config.git
synced 2025-10-11 07:10:39 +02:00
feat: add forgejo
This commit is contained in:
oddlama
parent
b57d86d1ce
commit
a975cc1f7f
12 changed files with 216 additions and 2 deletions
|
|
@ -60,11 +60,10 @@
|
|||
};
|
||||
in
|
||||
lib.genAttrs
|
||||
["kanidm" "grafana" "loki" "vaultwarden" "adguardhome" "influxdb"]
|
||||
["kanidm" "grafana" "loki" "vaultwarden" "adguardhome" "influxdb" "forgejo"]
|
||||
defaultConfig;
|
||||
|
||||
#ddclient = defineVm;
|
||||
#gitea/forgejo = defineVm;
|
||||
#samba+wsdd = defineVm;
|
||||
#fasten-health = defineVm;
|
||||
#immich = defineVm;
|
||||
|
|
|
|||
152
hosts/ward/microvms/forgejo.nix
Normal file
152
hosts/ward/microvms/forgejo.nix
Normal file
|
|
@ -0,0 +1,152 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
nodes,
|
||||
pkgs,
|
||||
utils,
|
||||
...
|
||||
}: let
|
||||
sentinelCfg = nodes.sentinel.config;
|
||||
forgejoDomain = "git.${sentinelCfg.repo.secrets.local.personalDomain}";
|
||||
in {
|
||||
# TODO forward ssh port
|
||||
meta.wireguard-proxy.sentinel.allowedTCPPorts = [
|
||||
config.services.gitea.settings.server.HTTP_PORT
|
||||
];
|
||||
|
||||
age.secrets.forgejo-mailer-password = {
|
||||
rekeyFile = config.node.secretsDir + "/forgejo-mailer-password.age";
|
||||
mode = "400";
|
||||
group = "forgejo";
|
||||
};
|
||||
|
||||
nodes.sentinel = {
|
||||
networking.providedDomains.forgejo = forgejoDomain;
|
||||
|
||||
services.nginx = {
|
||||
upstreams.forgejo = {
|
||||
servers."${config.services.gitea.settings.server.HTTP_ADDR}:${toString config.services.gitea.settings.server.HTTP_PORT}" = {};
|
||||
extraConfig = ''
|
||||
zone forgejo 64k;
|
||||
keepalive 2;
|
||||
'';
|
||||
};
|
||||
virtualHosts.${forgejoDomain} = {
|
||||
forceSSL = true;
|
||||
useACMEWildcardHost = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M;
|
||||
'';
|
||||
locations."/".proxyPass = "http://forgejo";
|
||||
locations."/metrics" = {
|
||||
proxyPass = "http://forgejo/metrics";
|
||||
extraConfig = ''
|
||||
allow 127.0.0.0/8;
|
||||
allow ::1;
|
||||
deny all;
|
||||
access_log off;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# XXX: TODO ssh if not using internal
|
||||
# AcceptEnv GIT_PROTOCOL
|
||||
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
package = pkgs.forgejo;
|
||||
appName = "Redlew Git"; # tungsten inert gas?
|
||||
stateDir = "/var/lib/forgejo";
|
||||
# TODO db backups
|
||||
# dump.enable = true;
|
||||
lfs.enable = true;
|
||||
mailerPasswordFile = config.age.secrets.forgejo-mailer-password.path;
|
||||
settings = {
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "https://gitea.com";
|
||||
};
|
||||
database = {
|
||||
SQLITE_JOURNAL_MODE = "WAL";
|
||||
LOG_SQL = false; # Leaks secrets
|
||||
};
|
||||
# federation.ENABLED = true;
|
||||
mailer = {
|
||||
ENABLED = true;
|
||||
HOST = config.repo.secrets.local.forgejo.mail.host;
|
||||
FROM = config.repo.secrets.local.forgejo.mail.from;
|
||||
USER = config.repo.secrets.local.forgejo.mail.user;
|
||||
SEND_AS_PLAIN_TEXT = true;
|
||||
};
|
||||
metrics = {
|
||||
# XXX: query with local telegraf
|
||||
ENABLED = true;
|
||||
ENABLED_ISSUE_BY_REPOSITORY = true;
|
||||
ENABLED_ISSUE_BY_LABEL = true;
|
||||
};
|
||||
oauth2_client = {
|
||||
ACCOUNT_LINKING = "auto";
|
||||
ENABLE_AUTO_REGISTRATION = true;
|
||||
OPENID_CONNECT_SCOPES = "email profile";
|
||||
REGISTER_EMAIL_CONFIRM = false;
|
||||
UPDATE_AVATAR = true;
|
||||
};
|
||||
# packages.ENABLED = true;
|
||||
repository = {
|
||||
DEFAULT_PRIVATE = false;
|
||||
ENABLE_PUSH_CREATE_USER = true;
|
||||
ENABLE_PUSH_CREATE_ORG = true;
|
||||
};
|
||||
server = {
|
||||
HTTP_ADDR = config.meta.wireguard.proxy-sentinel.ipv4;
|
||||
HTTP_PORT = 3000;
|
||||
DOMAIN = forgejoDomain;
|
||||
ROOT_URL = "https://${forgejoDomain}/";
|
||||
LANDING_PAGE = "/explore/repos";
|
||||
SSH_PORT = 9922;
|
||||
};
|
||||
service = {
|
||||
DISABLE_REGISTRATION = false;
|
||||
ALLOW_ONLY_INTERNAL_REGISTRATION = false;
|
||||
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
|
||||
SHOW_REGISTRATION_BUTTON = false;
|
||||
REGISTER_EMAIL_CONFIRM = false;
|
||||
ENABLE_NOTIFY_MAIL = true;
|
||||
REQUIRE_SIGNIN_VIEW = false;
|
||||
};
|
||||
session.COOKIE_SECURE = true;
|
||||
ui.DEFAULT_THEME = "forgejo-auto";
|
||||
"ui.meta" = {
|
||||
AUTHOR = "Redlew Git";
|
||||
DESCRIPTION = "Tungsten Inert Gas?";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.gitea = {
|
||||
after = ["sys-subsystem-net-devices-${utils.escapeSystemdPath "proxy-sentinel"}.device"];
|
||||
serviceConfig.RestartSec = "600"; # Retry every 10 minutes
|
||||
#preStart = let
|
||||
# exe = lib.getExe config.services.gitea.package;
|
||||
# providerName = "PrivateVoidAccount";
|
||||
# args = lib.escapeShellArgs [
|
||||
# "--name" providerName
|
||||
# "--provider" "openidConnect"
|
||||
# "--key" "net.privatevoid.forge1"
|
||||
# "--auto-discover-url" "https://login.${domain}/auth/realms/master/.well-known/openid-configuration"
|
||||
# "--group-claim-name" "groups"
|
||||
# "--admin-group" "/forge_admins@${domain}"
|
||||
# "--skip-local-2fa"
|
||||
# ];
|
||||
#in lib.mkAfter /* bash */ ''
|
||||
# provider_id=$(${exe} admin auth list | ${pkgs.gnugrep}/bin/grep -w '${providerName}' | cut -f1)
|
||||
# if [[ -z "$provider_id" ]]; then
|
||||
# FORGEJO_ADMIN_OAUTH2_SECRET="$(< ${secrets.forgejoOidcSecret.path})" ${exe} admin auth add-oauth ${args}
|
||||
# else
|
||||
# FORGEJO_ADMIN_OAUTH2_SECRET="$(< ${secrets.forgejoOidcSecret.path})" ${exe} admin auth update-oauth --id "$provider_id" ${args}
|
||||
# fi
|
||||
#'';
|
||||
};
|
||||
}
|
||||
9
hosts/ward/secrets/forgejo/forgejo-mailer-password.age
Normal file
9
hosts/ward/secrets/forgejo/forgejo-mailer-password.age
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
age-encryption.org/v1
|
||||
-> X25519 JlyIN/2lVHvsCqEgB/sz/zN8YwikwT2LnAQUMJGrq2g
|
||||
lmLvulEsfMNWxxgmUn5aIr7sHtd+kcBDybUzXr6n5no
|
||||
-> piv-p256 xqSe8Q Assr9n0it/QzKq8TOsx2t/MtEe92WMrXj+JJHo3RrT1n
|
||||
DdtEjsC+Uv3A2aEeMeSapWEBpsvM2JtdrE7I3m/bc5A
|
||||
-> >>"VV-grease S/>pq yum?k~& 85'4b7O
|
||||
BIM8LsHCxjlyY5TWwWV5P6qF
|
||||
--- /x2FdfG5vuiPmiE2369C0vQ16bhDqfSGAo6iJyPXtZE
|
||||
«¨HR¯õÚýû ‹@Y„A•ŠX‡¯¬Æ¼v¹à]—Ë“ÞôSzd¢ÈèæÕu˜‹Rj¶o Þ}µ¢ÍOÚ
|
||||
1
hosts/ward/secrets/forgejo/host.pub
Normal file
1
hosts/ward/secrets/forgejo/host.pub
Normal file
|
|
@ -0,0 +1 @@
|
|||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQOF4njC2ap3yl+0JDVEhkUjX0sxVx/nBrt+vt7bQKl
|
||||
9
hosts/ward/secrets/forgejo/local.nix.age
Normal file
9
hosts/ward/secrets/forgejo/local.nix.age
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
age-encryption.org/v1
|
||||
-> X25519 oa6IWrr6YZA553kin7UnrUFGBR7R8VE8WlfOskVH0Tk
|
||||
g5KsBunZ+QQVJTK3pqfLxeDwI7KIPJotZmnOYgLvcn8
|
||||
-> piv-p256 xqSe8Q Aru3YJbt0597SblXoXuzzRxUqbhCtrmbLPPKhv4fA9tZ
|
||||
Bo/hrsI5l10+vX5b8sM75PjLM5d3ipEvG4L+R9ex6Zo
|
||||
-> z#-grease (5#aXK, eq@?N[S
|
||||
gCAbCrw
|
||||
--- bFEmSOwIaMjE4AEM5vldWZuBNptNajgtGV/VNrK/pxU
|
||||
—ݸ}N¶“¼ôópÞ½°
Ãj»Û6çÝåê'5Àƒ=ô„?©J.UÂ<ïpmaè³ýý »$!5#[Ãþ œ
›üOa¿§2gBŠ¡=E¡»ob¬xK²Žx è©8C²Z8”S ©£a™";Ûø¤/S¹7)«ÖÃ'¤+Û)-�| YçÕ
HÖäêSÃ@¥G?ߌuñ
|
||||
13
hosts/ward/secrets/forgejo/telegraf-influxdb-token.age
Normal file
13
hosts/ward/secrets/forgejo/telegraf-influxdb-token.age
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
age-encryption.org/v1
|
||||
-> X25519 DCVhASEENA4z7QkZIAz+7shz69B3UGfuR4QwV28e3w4
|
||||
KcvcVb5PxsRMlA5n35c/4nRLdv7WoIL2bqJn6Ry0tBU
|
||||
-> piv-p256 xqSe8Q ArDV5TYzLEFhnRxXIY1OMPe4nPE7rtNhsUhU+7J2La3o
|
||||
SoqSbbPvxlF4uaGSRNKSumajM9aEr2EoHE8PyPr3sMk
|
||||
-> e\9`z-grease
|
||||
PtN7lO2jjyBoMojXSiPLmWGgv23uUbzd9TxrAwwDiCcBbW5RL5vvR2HFzc+k+ZVa
|
||||
RA3xLg5UeIzjsZdkWBezPHX1p7OALN49ZxtJ21fzfDhdUCTfVIKK4mi++At2hEJF
|
||||
6g
|
||||
--- FdR7X/jFWv+BhzuO8kpGr8xC3SKgmrwHg4YaHRxnwHE
|
||||
¶ßÌÚÝp 6SD´…˜W(¶YRÜ3ƒs_Ûª/2 g}Äܶ§W?ub
|
||||
)‘¯/û ,{÷&ƒ Fÿ-ŒØ5£ß/u.�p¬ \%ÊÉŸæ—üï4qÓ‰�ð Û ˜yKQk4W™3÷ËŒ
|
||||
§Óˆ[ Áþ°t‡__4y× ±q�¬^/Fש*
|
||||
Loading…
Add table
Add a link
Reference in a new issue