From 229738cec69d101bcb64e9af2a4ca25c15edec23 Mon Sep 17 00:00:00 2001
From: Matt Nish-Lapidus <matt@emenel.ca>
Date: Wed, 16 Apr 2025 11:41:35 -0400
Subject: [PATCH] forgejo

---
 hosts/emenel-services/configuration.nix |  4 +---
 modules/system/forgejo.nix              | 23 +++++++++++++++++++++--
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/hosts/emenel-services/configuration.nix b/hosts/emenel-services/configuration.nix
index 5ecb1a9..1c6e076 100644
--- a/hosts/emenel-services/configuration.nix
+++ b/hosts/emenel-services/configuration.nix
@@ -75,9 +75,6 @@
     gnupg
     util-linux
     git
-    forgejo
-    forgejo-cli
-    forgejo-runner
   ];
 
   users.users.emenel = {
@@ -90,6 +87,7 @@
       "network"
       "wheel"
       "uinput"
+      "forgejo"
     ];
     packages = with pkgs; [
       git
diff --git a/modules/system/forgejo.nix b/modules/system/forgejo.nix
index de5bdc2..c417a2d 100644
--- a/modules/system/forgejo.nix
+++ b/modules/system/forgejo.nix
@@ -6,7 +6,6 @@ in
   services = {
     forgejo = {
       enable = true;
-      package = pkgs.forgejo;
       lfs = {
         enable = true;
       };
@@ -62,7 +61,27 @@ in
     # };
   };
 
-  #   sops.secrets.forgejo-emenel.owner = "forgejo";
+  environment.systemPackages = let
+    cfg = config.services.forgejo;
+    forgejo-cli = pkgs.writeScriptBin "forgejo-cli" ''
+      #!${pkgs.runtimeShell}
+      cd ${cfg.stateDir}
+      sudo=exec
+      if [[ "$USER" != forgejo ]]; then
+        sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM'
+      fi
+      # Note that these variable names will change
+      export GITEA_WORK_DIR=${cfg.stateDir}
+      export GITEA_CUSTOM=${cfg.customDir}
+      $sudo ${lib.getExe cfg.package} "$@"
+  '';
+  in [
+    forgejo-cli
+    pkgs.forgejo
+    pkgs.forgejo-runner
+  ];
+
+#   sops.secrets.forgejo-emenel.owner = "forgejo";
 #   systemd.services.forgejo.preStart = let
 #     adminCmd = "${lib.getExe pkgs.forgejo} admin user";
 #     pwd = config.sops.secrets.forgejo-emenel;