nix

configuration files that power my machines
Log | Files | Refs | README | LICENSE

forgejo.nix (3455B)

      1 {
      2   config,
      3   lib,
      4   pkgs,
      5   haravara,
      6   ...
      7 }: let
      8   cfg = config.services.haravara.forgejo;
      9 in {
     10   options.services.haravara.forgejo = {
     11     enable = lib.mkEnableOption "Forgejo git service";
     12     httpPort = lib.mkOption {
     13       type = lib.types.port;
     14       default = 3482;
     15       description = "Internal HTTP port for Forgejo";
     16     };
     17     sshPort = lib.mkOption {
     18       type = lib.types.port;
     19       default = 22;
     20       description = "SSH port for Forgejo";
     21     };
     22 
     23     domain = lib.mkOption {
     24       type = lib.types.str;
     25     };
     26   };
     27 
     28   config = lib.mkIf cfg.enable {
     29     users = {
     30       users.forgejo = {
     31         isSystemUser = true;
     32         group = lib.mkForce "forgejo";
     33       };
     34     };
     35 
     36     systemd = {
     37       tmpfiles.rules = [
     38         "d /data/forgejo 0700 forgejo forgejo -"
     39         "d /data/forgejo/repositories 0700 forgejo forgejo -"
     40         "d /var/lib/forgejo 0700 forgejo forgejo -"
     41         "d /var/lib/forgejo/custom 0700 forgejo forgejo -"
     42         "d /var/lib/forgejo/custom/conf 0700 forgejo forgejo -"
     43       ];
     44 
     45       services.forgejo = {
     46         serviceConfig.TimeoutSec = 3600;
     47       };
     48     };
     49 
     50     fileSystems."/var/lib/forgejo/repositories" = {
     51       device = "/data/forgejo/repositories";
     52       fsType = "none";
     53       options = ["bind" "nofail"];
     54     };
     55 
     56     services = {
     57       forgejo = {
     58         enable = true;
     59         package = pkgs.forgejo;
     60         stateDir = "/var/lib/forgejo";
     61         database.type = "sqlite3";
     62         lfs.enable = true;
     63 
     64         secrets = {
     65           "FORGEJO__SECURITY__SECRET_KEY".path = "/var/lib/forgejo/custom/conf/secret_key";
     66           "FORGEJO__SECURITY__INTERNAL_TOKEN".path = "/var/lib/forgejo/custom/conf/internal_token";
     67           "FORGEJO__OAUTH2__JWT_SECRET".path = "/var/lib/forgejo/custom/conf/oauth2_jwt_secret";
     68           "FORGEJO__SERVER__LFS_JWT_SECRET".path = "/var/lib/forgejo/custom/conf/lfs_jwt_secret";
     69         };
     70 
     71         settings = {
     72           DEFAULT = {
     73             APP_NAME = cfg.domain;
     74           };
     75           server = {
     76             DOMAIN = cfg.domain;
     77             SSH_DOMAIN = haravara.stripSubdomain cfg.domain;
     78             ROOT_URL = "https://${cfg.domain}/";
     79             HTTP_PORT = cfg.httpPort;
     80             HTTP_ADDR = "127.0.0.1";
     81             SSH_PORT = cfg.sshPort;
     82             SSH_LISTEN_PORT = cfg.sshPort;
     83           };
     84           other = {
     85             SHOW_FOOTER_VERSION = false;
     86           };
     87           repository = {
     88             FORCE_CHMOD_OFF = true;
     89             MAX_CREATION_LIMIT = 0;
     90           };
     91           service = {
     92             DISABLE_REGISTRATION = true;
     93           };
     94           "repository.signing" = {
     95             TRUST_MODEL = "committer";
     96           };
     97           "git.timeout" = {
     98             DEFAULT = 3600;
     99             EVENT = 3600;
    100             PULL = 3600;
    101           };
    102           mailer = {
    103             ENABLED = false;
    104           };
    105         };
    106       };
    107 
    108       openssh.ports = [cfg.sshPort];
    109 
    110       caddy.virtualHosts."${cfg.domain}".extraConfig = ''
    111         # Bypass auth for Docker Registry and Git CLI
    112         @cli_paths {
    113           path /v2/*
    114           path */info/refs*
    115           path */git-upload-pack*
    116           path */git-receive-pack*
    117         }
    118 
    119         handle @cli_paths {
    120           reverse_proxy 127.0.0.1:${toString cfg.httpPort}
    121         }
    122 
    123         handle {
    124           import remote_auth
    125           reverse_proxy 127.0.0.1:${toString cfg.httpPort}
    126         }
    127       '';
    128     };
    129 
    130     networking.firewall.allowedTCPPorts = [cfg.sshPort];
    131   };
    132 }