103 lines
2.7 KiB
Nix
103 lines
2.7 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
options.chvp.services.git.enable = lib.mkOption {
|
|
default = false;
|
|
example = true;
|
|
};
|
|
|
|
imports = [ ./runner.nix ];
|
|
|
|
config = lib.mkIf config.chvp.services.git.enable {
|
|
chvp.services.nginx.hosts = [
|
|
{
|
|
fqdn = "git.chvp.be";
|
|
options = {
|
|
locations."/" = {
|
|
proxyPass = "http://unix:/run/forgejo/forgejo.socket";
|
|
extraConfig = ''
|
|
client_max_body_size 50M;
|
|
'';
|
|
};
|
|
};
|
|
}
|
|
];
|
|
users = {
|
|
users = {
|
|
git = {
|
|
home = "/var/lib/forgejo";
|
|
group = "git";
|
|
isSystemUser = true;
|
|
useDefaultShell = true;
|
|
};
|
|
nginx.extraGroups = [ "git" ];
|
|
};
|
|
groups.git = { };
|
|
};
|
|
services = {
|
|
forgejo = {
|
|
enable = true;
|
|
package = pkgs.forgejo;
|
|
stateDir = "/var/lib/forgejo";
|
|
user = "git";
|
|
group = "git";
|
|
database = {
|
|
type = "postgres";
|
|
user = "git";
|
|
name = "git";
|
|
createDatabase = true;
|
|
};
|
|
settings = {
|
|
repository = {
|
|
ENABLE_PUSH_CREATE_USER = true;
|
|
ENABLE_PUSH_CREATE_ORG = true;
|
|
};
|
|
server = {
|
|
DOMAIN = "git.chvp.be";
|
|
PROTOCOL = "http+unix";
|
|
ROOT_URL = "https://git.chvp.be/";
|
|
HTTP_ADDR = "/run/forgejo/forgejo.socket";
|
|
};
|
|
service = {
|
|
EMAIL_DOMAIN_ALLOWLIST = "vanpetegem.be";
|
|
ENABLE_NOTIFY_MAIL = true;
|
|
};
|
|
mailer = {
|
|
ENABLED = true;
|
|
PROTOCOL = "smtps";
|
|
SMTP_ADDR = "mail.vanpetegem.me";
|
|
SMPT_PORT = 465;
|
|
USER = "git@chvp.be";
|
|
FROM = "Git <git@chvp.be>";
|
|
};
|
|
"email.incoming" = {
|
|
ENABLED = true;
|
|
REPLY_TO_ADDRESS = "git+%{token}@chvp.be";
|
|
HOST = "mail.vanpetegem.me";
|
|
PORT = 993;
|
|
USERNAME = "git@chvp.be";
|
|
USE_TLS = true;
|
|
};
|
|
session = {
|
|
COOKIE_SECURE = true;
|
|
PROVIDER = "db";
|
|
COOKIE_NAME = "forgejo_session";
|
|
};
|
|
log = {
|
|
ROOT_PATH = "/var/log/forgejo";
|
|
};
|
|
};
|
|
secrets = {
|
|
mailer.PASSWD = config.age.secrets."passwords/services/git/mail-password".path;
|
|
"email.incoming".PASSWORD = config.age.secrets."passwords/services/git/mail-password".path;
|
|
};
|
|
};
|
|
};
|
|
age.secrets = {
|
|
"passwords/services/git/mail-password" = {
|
|
file = ../../../../secrets/passwords/services/git/mail-password.age;
|
|
owner = "git";
|
|
};
|
|
};
|
|
};
|
|
}
|