From 0a5754541bb01e96021ca7ee74f1256a8ee68bc4 Mon Sep 17 00:00:00 2001
From: tdback <tyler@tdback.net>
Date: Sat, 21 Dec 2024 15:32:13 -0500
Subject: initial commit to self-hosted git

---
 modules/retired/forgejo/default.nix | 65 +++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 modules/retired/forgejo/default.nix

(limited to 'modules/retired/forgejo/default.nix')

diff --git a/modules/retired/forgejo/default.nix b/modules/retired/forgejo/default.nix
new file mode 100644
index 0000000..9db55b2
--- /dev/null
+++ b/modules/retired/forgejo/default.nix
@@ -0,0 +1,65 @@
+{ inputs, config, lib, pkgs, ... }:
+let
+  domain = "git.tdback.net";
+  port = 3000;
+in
+{
+  services.forgejo = {
+    enable = true;
+    package = pkgs.unstable.forgejo;
+    stateDir = "/tank/forgejo";
+    database.type = "postgres";
+    lfs.enable = true;
+    settings = {
+      server = {
+        DOMAIN = domain;
+        ROOT_URL = "https://${domain}/";
+        HTTP_PORT = port;
+      };
+      service.DISABLE_REGISTRATION = true;
+      actions = {
+        ENABLED = true;
+        DEFAULT_ACTIONS_URL = "https://${domain}";
+      };
+    };
+  };
+
+  age.secrets.forgejoAdminPass = {
+    file = "${inputs.self}/secrets/forgejoAdminPass.age";
+    mode = "770";
+    owner = "forgejo";
+    group = "forgejo";
+  };
+
+  systemd.services.forgejo.preStart =
+    let
+      adminCmd = "${lib.getExe config.services.forgejo.package} admin user";
+      password = config.age.secrets.forgejoAdminPass.path;
+      user = "tdback";
+      email = "tyler@tdback.net";
+    in ''
+      ${adminCmd} create --admin --email ${email} --username ${user} --password "$(tr -d '\n' < ${password})" || true
+    '';
+
+  services.openssh.settings.AllowUsers = [ "forgejo" ];
+
+  services.caddy.virtualHosts.${domain}.extraConfig = ''
+    encode zstd gzip
+    reverse_proxy http://localhost:${builtins.toString port}
+  '';
+
+  age.secrets.forgejoRunnerToken.file = "${inputs.self}/secrets/forgejoRunnerToken.age";
+  services.gitea-actions-runner = {
+    package = pkgs.unstable.forgejo-runner;
+    instances.default = {
+      enable = true;
+      name = "monolith";
+      url = "https://${domain}";
+      tokenFile = config.age.secrets.forgejoRunnerToken.path;
+      labels = [
+        "ubuntu-latest:docker://node:20-bookworm"
+        "ubuntu-22.04:docker://node:20-bookworm"
+      ];
+    };
+  };
+}
-- 
cgit v1.2.3