phandom: add forgejo server

This commit is contained in:
Leonardo Eugênio 2024-04-06 20:38:35 -03:00
parent 8de573b35c
commit 5edca9c2c6
7 changed files with 70 additions and 2 deletions

View file

@ -12,6 +12,7 @@
./writefreely.nix ./writefreely.nix
./renawiki.nix ./renawiki.nix
./email.nix ./email.nix
./forgejo.nix
]; ];
# # Enable networking # # Enable networking

View file

@ -9,13 +9,21 @@
mailserver = { mailserver = {
enable = true; enable = true;
fqdn = "mail.lelgenio.xyz"; fqdn = "mail.lelgenio.xyz";
domains = [ "lelgenio.xyz" ]; domains = [
"lelgenio.xyz"
"git.lelgenio.xyz"
];
certificateScheme = "acme-nginx"; certificateScheme = "acme-nginx";
# Create passwords with
# nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
loginAccounts = { loginAccounts = {
"lelgenio@lelgenio.xyz" = { "lelgenio@lelgenio.xyz" = {
hashedPassword = "$2y$05$z5s7QCXcs5uTFsfyYpwNJeWzb3RmzgWxNgcPCr0zjSytkLFF/qZmS"; hashedPassword = "$2y$05$z5s7QCXcs5uTFsfyYpwNJeWzb3RmzgWxNgcPCr0zjSytkLFF/qZmS";
aliases = [ "postmaster@lelgenio.xyz" ]; aliases = [ "postmaster@lelgenio.xyz" ];
}; };
"noreply@git.lelgenio.xyz" = {
hashedPassword = "$2b$05$TmR1R7ZwXfec7yrOfeBL7u3ZtyXf0up5dEO6uMWSvb/O7LPEm.j0.";
};
}; };
}; };

56
hosts/phantom/forgejo.nix Normal file
View file

@ -0,0 +1,56 @@
{ lib, pkgs, config, ... }:
let
cfg = config.services.forgejo;
srv = cfg.settings.server;
in
{
services.nginx = {
virtualHosts.${cfg.settings.server.DOMAIN} = {
forceSSL = true;
enableACME = true;
extraConfig = ''
client_max_body_size 512M;
'';
locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
};
};
services.openssh = {
authorizedKeysFiles = [
"${config.services.forgejo.stateDir}/.ssh/authorized_keys"
];
# Recommended by forgejo: https://forgejo.org/docs/latest/admin/recommendations/#git-over-ssh
settings.AcceptEnv = "GIT_PROTOCOL";
};
services.forgejo = {
enable = true;
database.type = "postgres";
lfs.enable = true;
settings = {
service.DISABLE_REGISTRATION = true;
actions = {
ENABLED = true;
DEFAULT_ACTIONS_URL = "github";
};
server = {
DOMAIN = "git.lelgenio.xyz";
HTTP_PORT = 3000;
ROOT_URL = "https://${srv.DOMAIN}/";
};
mailer = {
ENABLED = true;
SMTP_ADDR = "mail.lelgenio.xyz";
FROM = "noreply@git.lelgenio.xyz";
USER = "noreply@git.lelgenio.xyz";
};
};
mailerPasswordFile = config.age.secrets.phantom-forgejo-mailer-password.path;
};
age.secrets.phantom-forgejo-mailer-password = {
file = ../../secrets/phantom-forgejo-mailer-password.age;
mode = "400";
owner = "forgejo";
};
}

View file

@ -2,7 +2,7 @@
security.rtkit.enable = true; security.rtkit.enable = true;
services.openssh = { services.openssh = {
enable = true; enable = true;
ports = [ 9022 ]; ports = [ 9022 22 ];
settings = { settings = {
PasswordAuthentication = false; PasswordAuthentication = false;
KbdInteractiveAuthentication = false; KbdInteractiveAuthentication = false;

Binary file not shown.

View file

@ -10,4 +10,5 @@ in
"phantom-nextcloud.age".publicKeys = [ main_ssh_public_key ]; "phantom-nextcloud.age".publicKeys = [ main_ssh_public_key ];
"phantom-writefreely.age".publicKeys = [ main_ssh_public_key ]; "phantom-writefreely.age".publicKeys = [ main_ssh_public_key ];
"phantom-renawiki.age".publicKeys = [ main_ssh_public_key ]; "phantom-renawiki.age".publicKeys = [ main_ssh_public_key ];
"phantom-forgejo-mailer-password.age".publicKeys = [ main_ssh_public_key ];
} }

View file

@ -10,5 +10,7 @@
../secrets/rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.age; ../secrets/rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.age;
secrets.monolith-nix-serve-privkey.file = secrets.monolith-nix-serve-privkey.file =
../secrets/monolith-nix-serve-privkey.age; ../secrets/monolith-nix-serve-privkey.age;
secrets.phantom-forgejo-mailer-password.file =
../secrets/phantom-forgejo-mailer-password.age;
}; };
} }