auth and git

fili/services/forgejo.nix

@@ -0,0 +1,76 @@
+{ lib, pkgs, config, ... }:
+let
+  cfg = config.services.forgejo;
+  srv = cfg.settings.server;
+in
+{
+  sops.secrets.forgejo = {
+    sopsFile = ../../secrets/forgejo.yaml;
+    key="email_password";
+    format = "yaml";
+  };
+
+  users.groups.forgejo = { };
+  users.users.forgejo = {
+    isSystemUser = true;
+    group = "forgejo";
+    extraGroups = [ "storage" ];
+  };
+
+  services.nginx = {
+    virtualHosts."git.donsz.nl" = {
+      forceSSL = true;
+      enableACME = true;
+      extraConfig = ''
+        client_max_body_size 512M;
+      '';
+      locations."/".proxyPass = "http://[::1]:13121";
+    };
+  };
+
+  services.forgejo = {
+    enable = true;
+    lfs.enable = true;
+    user = "forgejo";
+    group = "forgejo";
+    repositoryRoot="/storage/storage/git";
+
+    database = {
+      type = "postgres";
+      name = "forgejo";
+      createDatabase = false;
+    };
+
+    settings = {
+      DEFAULT = {
+        APP_NAME="jana's git server";
+        APP_SLOGAN="meow!";
+      };
+      server = {
+        DOMAIN = "git.donsz.nl";
+        ROOT_URL = "https://git.donsz.nl/";
+        HTTP_PORT = 13121;
+      };
+      service = {
+        DISABLE_REGISTRATION = true;
+        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+        SHOW_REGISTRATION_BUTTON = false;
+        ENABLE_PASSWORD_SIGNIN_FORM = false;
+      };
+      actions = {
+        ENABLED = true;
+        DEFAULT_ACTIONS_URL = "github";
+      };
+      repository = {
+        DEFAULT_PRIVATE="private";
+      };
+      mailer = {
+        ENABLED = true;
+        SMTP_ADDR = "smtp.fastmail.com";
+        FROM = "git@donsz.nl";
+        USER = "git@donsz.nl";
+      };
+    };
+    mailerPasswordFile = config.sops.secrets.forgejo.path;
+  };
+}