obsidian

fili/services/forgejo.nix

@@ -1,9 +1,8 @@
-{
-  lib,
-  pkgs,
-  config,
-  flakes,
-  ...
+{ lib
+, pkgs
+, config
+, flakes
+, ...
 }:
 let
   cfg = config.services.forgejo;
@@ -15,23 +14,29 @@ in
     key = "email_password";
     format = "yaml";
   };
-
-  users.groups.forgejo = { };
-  users.users.forgejo = {
-    isSystemUser = true;
-    group = "forgejo";
-    extraGroups = [ "storage" ];
+  users = {
+    groups = {
+      forgejo = { };
+      forgejo-runner = { };
+    };
+    users.forgejo = {
+      isSystemUser = true;
+      group = "forgejo";
+      extraGroups = [ "storage" ];
+    };
+    users.forgejo-runner = {
+      isSystemUser = true;
+      group = "forgejo-runner";
+    };
   };
 
-  services.nginx = {
-    virtualHosts."git.donsz.nl" = {
-      forceSSL = true;
-      enableACME = true;
-      extraConfig = ''
-        client_max_body_size 512M;
-      '';
-      locations."/".proxyPass = "http://[::1]:13121";
-    };
+  services.nginx.virtualHosts."git.donsz.nl" = {
+    forceSSL = true;
+    enableACME = true;
+    extraConfig = ''
+      client_max_body_size 512M;
+    '';
+    locations."/".proxyPass = "http://[::1]:13121";
   };
 
   services.forgejo = {
@@ -80,12 +85,6 @@ in
     mailerPasswordFile = config.sops.secrets.forgejo.path;
   };
 
-  users.groups.forgejo-runner = { };
-  users.users.forgejo-runner = {
-    isSystemUser = true;
-    group = "forgejo-runner";
-  };
-
   sops.secrets.forgejo-runner = {
     sopsFile = ../../secrets/forgejo-runner.env;
   };