103 lines
3.2 KiB
Nix
103 lines
3.2 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
let
|
|
port = 12345;
|
|
in
|
|
{
|
|
services = {
|
|
forgejo = {
|
|
enable = true;
|
|
package = pkgs.forgejo;
|
|
lfs = {
|
|
enable = true;
|
|
};
|
|
stateDir = "/mnt/git-storage";
|
|
settings = {
|
|
default = {
|
|
APP_NAME = "safe harbour";
|
|
};
|
|
server = {
|
|
DOMAIN = "gt.emenel.ca";
|
|
ROOT_URL = "https://gt.emenel.ca/";
|
|
HTTP_PORT = port;
|
|
};
|
|
repository = {
|
|
DEFAULT_BRANCH = "main";
|
|
};
|
|
service.DISABLE_REGISTRATION = true;
|
|
actions = {
|
|
ENABLED = true;
|
|
DEFAULT_ACTIONS_URL = "github";
|
|
};
|
|
mailer = {
|
|
ENABLED = true;
|
|
SMTP_ADDR = "smtp.mailgun.org";
|
|
SMTP_PORT = 587;
|
|
FROM = "git@gt.emenel.ca";
|
|
USER = "git@gt.emenel.ca";
|
|
};
|
|
};
|
|
secrets = {
|
|
mailer.PASSWD = config.sops.secrets.forgejo-smtp.path;
|
|
};
|
|
};
|
|
|
|
caddy.virtualHosts."gt.emenel.ca" = {
|
|
extraConfig = ''
|
|
reverse_proxy http://localhost:12345 {
|
|
header_down X-Real-IP {http.request.remote}
|
|
header_down X-Forwarded-For {http.request.remote}
|
|
}
|
|
'';
|
|
};
|
|
|
|
# gitea-actions-runner = {
|
|
# package = pkgs.forgejo-actions-runner;
|
|
# instances.default = {
|
|
# enable = true;
|
|
# name = "monolith";
|
|
# url = "https://git.example.com";
|
|
# # Obtaining the path to the runner token file may differ
|
|
# # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
|
|
# tokenFile = config.age.secrets.forgejo-runner-token.path;
|
|
# labels = [
|
|
# "ubuntu-latest:docker://node:16-bullseye"
|
|
# "ubuntu-22.04:docker://node:16-bullseye"
|
|
# "ubuntu-20.04:docker://node:16-bullseye"
|
|
# "ubuntu-18.04:docker://node:16-buster"
|
|
# ## optionally provide native execution on the host:
|
|
# # "native:host"
|
|
# ];
|
|
# };
|
|
# };
|
|
};
|
|
|
|
environment.systemPackages = let
|
|
cfg = config.services.forgejo;
|
|
forgejo-cli = pkgs.writeScriptBin "forgejo-cli" ''
|
|
#!${pkgs.runtimeShell}
|
|
cd ${cfg.stateDir}
|
|
sudo=exec
|
|
if [[ "$USER" != forgejo ]]; then
|
|
sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM'
|
|
fi
|
|
# Note that these variable names will change
|
|
export GITEA_WORK_DIR=${cfg.stateDir}
|
|
export GITEA_CUSTOM=${cfg.customDir}
|
|
$sudo ${lib.getExe cfg.package} "$@"
|
|
'';
|
|
in [
|
|
forgejo-cli
|
|
];
|
|
|
|
# sops.secrets.forgejo-emenel.owner = "forgejo";
|
|
# systemd.services.forgejo.preStart = let
|
|
# adminCmd = "${lib.getExe pkgs.forgejo} admin user";
|
|
# pwd = config.sops.secrets.forgejo-emenel;
|
|
# user = "emenel"; # Note, Forgejo doesn't allow creation of an account named "admin"
|
|
# in ''
|
|
# ${adminCmd} create --admin --email "matt@emenel.ca" --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
|
|
# ## uncomment this line to change an admin user which was already created
|
|
# # ${adminCmd} change-password --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
|
|
# '';
|
|
|
|
}
|