services: forgejo: init

This commit is contained in:
Antoine Martin 2024-05-26 21:38:21 +02:00
parent 298dd249f5
commit 443b76f235
3 changed files with 144 additions and 0 deletions

View file

@ -3,6 +3,7 @@
./vaultwarden.nix
./fail2ban.nix
./fava.nix
./forgejo
./gitea
./immich.nix
./jellyfin.nix

View file

@ -0,0 +1,126 @@
{
config,
lib,
pkgs,
...
}: let
inherit
(lib)
mkEnableOption
mkIf
mkOption
;
cfg = config.my.services.forgejo;
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
forgejoUser = "git";
in {
options.my.services.forgejo = let
inherit (lib) types;
in {
enable = mkEnableOption "Personal Git hosting with Forgejo";
privatePort = mkOption {
type = types.port;
default = 8082;
example = 8082;
description = "Port to serve the app";
};
};
config = mkIf cfg.enable {
# use git as user to have `git clone git@git.domain`
users.users.${forgejoUser} = {
description = "Forgejo Service";
home = config.services.forgejo.stateDir;
useDefaultShell = true;
group = forgejoUser;
# the systemd service for the forgejo module seems to hardcode the group as
# forgejo, so, uh, just in case?
extraGroups = ["forgejo"];
isSystemUser = true;
};
users.groups.${forgejoUser} = {};
services.forgejo = {
enable = true;
user = forgejoUser;
appName = "Personal Forge";
lfs.enable = true;
settings = {
server = {
ROOT_URL = "https://git.${domain}/";
DOMAIN = "git.${domain}";
HTTP_ADDR = "127.0.0.1";
HTTP_PORT = cfg.privatePort;
};
log.LEVEL = "Warn"; # [ "Trace" "Debug" "Info" "Warn" "Error" "Critical" ]
other.SHOW_FOOTER_VERSION = false;
repository = {
ENABLE_PUSH_CREATE_USER = true;
DEFAULT_BRANCH = "main";
};
# NOTE: temporarily remove this for initial setup
service.DISABLE_REGISTRATION = true;
# only send cookies via HTTPS
session.COOKIE_SECURE = true;
};
# NixOS module uses `forgejo dump` to backup repositories and the database,
# but it produces a single .zip file that's not very restic friendly.
# I configure my backup system manually below.
dump.enable = false;
database = {
type = "postgres";
# user needs to be the same as forgejo user
user = forgejoUser;
name = forgejoUser;
};
};
# FIXME: Borg *could* be backing up files while they're being edited by
# forgejo, so it may produce corrupt files in the snapshot if I push stuff
# around midnight. I'm not sure how `forgejo dump` handles this either,
# though.
my.services.restic-backup = {
paths = [
config.services.forgejo.lfs.contentDir
config.services.forgejo.repositoryRoot
];
};
# NOTE: no need to use postgresql.ensureDatabases because the forgejo module
# takes care of this automatically
services.postgresqlBackup = {
databases = [config.services.forgejo.database.name];
};
services.nginx = {
virtualHosts = {
"git.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
};
};
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["git.${domain}"];
systemd.services.forgejo.preStart = "${pkgs.coreutils}/bin/ln -sfT ${./templates} ${config.services.forgejo.stateDir}/custom/templates";
};
}

View file

@ -0,0 +1,17 @@
{{template "base/head" .}}
<div class="page-content home">
<div class="ui stackable middle very relaxed page grid">
<div class="sixteen wide center aligned centered column">
<div>
<img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
</div>
<div class="hero">
<h1 class="ui icon header title">
{{AppName}}
</h1>
<h2>alarsyo's personal projects are hosted here</h2>
</div>
</div>
</div>
</div>
{{template "base/footer" .}}