From 5edca9c2c6de8fb069a108c7edf105b15e16fef8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Leonardo=20Eug=C3=AAnio?= Date: Sat, 6 Apr 2024 20:38:35 -0300 Subject: [PATCH] phandom: add forgejo server --- hosts/phantom/default.nix | 1 + hosts/phantom/email.nix | 10 +++- hosts/phantom/forgejo.nix | 56 ++++++++++++++++++++ hosts/phantom/users.nix | 2 +- secrets/phantom-forgejo-mailer-password.age | Bin 0 -> 678 bytes secrets/secrets.nix | 1 + system/secrets.nix | 2 + 7 files changed, 70 insertions(+), 2 deletions(-) create mode 100644 hosts/phantom/forgejo.nix create mode 100644 secrets/phantom-forgejo-mailer-password.age diff --git a/hosts/phantom/default.nix b/hosts/phantom/default.nix index 47b8757..782b783 100644 --- a/hosts/phantom/default.nix +++ b/hosts/phantom/default.nix @@ -12,6 +12,7 @@ ./writefreely.nix ./renawiki.nix ./email.nix + ./forgejo.nix ]; # # Enable networking diff --git a/hosts/phantom/email.nix b/hosts/phantom/email.nix index 8d3021b..fbe33d7 100644 --- a/hosts/phantom/email.nix +++ b/hosts/phantom/email.nix @@ -9,13 +9,21 @@ mailserver = { enable = true; fqdn = "mail.lelgenio.xyz"; - domains = [ "lelgenio.xyz" ]; + domains = [ + "lelgenio.xyz" + "git.lelgenio.xyz" + ]; certificateScheme = "acme-nginx"; + # Create passwords with + # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt' loginAccounts = { "lelgenio@lelgenio.xyz" = { hashedPassword = "$2y$05$z5s7QCXcs5uTFsfyYpwNJeWzb3RmzgWxNgcPCr0zjSytkLFF/qZmS"; aliases = [ "postmaster@lelgenio.xyz" ]; }; + "noreply@git.lelgenio.xyz" = { + hashedPassword = "$2b$05$TmR1R7ZwXfec7yrOfeBL7u3ZtyXf0up5dEO6uMWSvb/O7LPEm.j0."; + }; }; }; diff --git a/hosts/phantom/forgejo.nix b/hosts/phantom/forgejo.nix new file mode 100644 index 0000000..94b7169 --- /dev/null +++ b/hosts/phantom/forgejo.nix @@ -0,0 +1,56 @@ +{ lib, pkgs, config, ... }: +let + cfg = config.services.forgejo; + srv = cfg.settings.server; +in +{ + services.nginx = { + virtualHosts.${cfg.settings.server.DOMAIN} = { + forceSSL = true; + enableACME = true; + extraConfig = '' + client_max_body_size 512M; + ''; + locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}"; + }; + }; + + services.openssh = { + authorizedKeysFiles = [ + "${config.services.forgejo.stateDir}/.ssh/authorized_keys" + ]; + # Recommended by forgejo: https://forgejo.org/docs/latest/admin/recommendations/#git-over-ssh + settings.AcceptEnv = "GIT_PROTOCOL"; + }; + + services.forgejo = { + enable = true; + database.type = "postgres"; + lfs.enable = true; + settings = { + service.DISABLE_REGISTRATION = true; + actions = { + ENABLED = true; + DEFAULT_ACTIONS_URL = "github"; + }; + server = { + DOMAIN = "git.lelgenio.xyz"; + HTTP_PORT = 3000; + ROOT_URL = "https://${srv.DOMAIN}/"; + }; + mailer = { + ENABLED = true; + SMTP_ADDR = "mail.lelgenio.xyz"; + FROM = "noreply@git.lelgenio.xyz"; + USER = "noreply@git.lelgenio.xyz"; + }; + }; + mailerPasswordFile = config.age.secrets.phantom-forgejo-mailer-password.path; + }; + + age.secrets.phantom-forgejo-mailer-password = { + file = ../../secrets/phantom-forgejo-mailer-password.age; + mode = "400"; + owner = "forgejo"; + }; +} diff --git a/hosts/phantom/users.nix b/hosts/phantom/users.nix index 5cc853a..75aee27 100644 --- a/hosts/phantom/users.nix +++ b/hosts/phantom/users.nix @@ -2,7 +2,7 @@ security.rtkit.enable = true; services.openssh = { enable = true; - ports = [ 9022 ]; + ports = [ 9022 22 ]; settings = { PasswordAuthentication = false; KbdInteractiveAuthentication = false; diff --git a/secrets/phantom-forgejo-mailer-password.age b/secrets/phantom-forgejo-mailer-password.age new file mode 100644 index 0000000000000000000000000000000000000000..90fbe735e74103886baaf56a7bef66d16e8233ab GIT binary patch literal 678 zcmV~$yNlCs003Y?K?n!VI>?EfgQ4b~G>gzCm*)Ly+N5!@c{E9zHf^52b`eC-MQ}LK z#Z?d-Mcm|e!C7$-2R-~76#Tw<68GXwSnjuVR&4GSWrDOA)VqINRcWuR=EuXX17ZRR z16m42QA_7YpAlL7z=?7u*a&IYI5V+4%pb4|5~WED5No`xVAy8@+VcEN=L<%iLayv& z0fiC6oLL_V&0)eBqYVx-Z)XCrSy?M$gImfFPKa&+Zz{`ZYa{dvFDip%FRK8GEw;iE z6R@(9rSN_xM9Wm-eUUID0ZyxBI+ZBE8i31vekSIgL>DZJ6tO&V*Mn}FL%y>?^S~v= zoUb`jX*DsPvE_=}&$V&HC5|xigoch5pppFkVKwYysA>Z{LId6PMrr^}bo3x&o#BPMaZ_kUO|C84dTXiGM@)V zToUeZZE};Mugqcqh%n1k17sFiGezX;8bfNHPi@r+b_#v?^7ZnAOMiddymj>Y{2 literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 9bc7c27..9a5fe2b 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -10,4 +10,5 @@ in "phantom-nextcloud.age".publicKeys = [ main_ssh_public_key ]; "phantom-writefreely.age".publicKeys = [ main_ssh_public_key ]; "phantom-renawiki.age".publicKeys = [ main_ssh_public_key ]; + "phantom-forgejo-mailer-password.age".publicKeys = [ main_ssh_public_key ]; } diff --git a/system/secrets.nix b/system/secrets.nix index 0d0870b..22c5d14 100644 --- a/system/secrets.nix +++ b/system/secrets.nix @@ -10,5 +10,7 @@ ../secrets/rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.age; secrets.monolith-nix-serve-privkey.file = ../secrets/monolith-nix-serve-privkey.age; + secrets.phantom-forgejo-mailer-password.file = + ../secrets/phantom-forgejo-mailer-password.age; }; }