84 lines
2.3 KiB
Nix
84 lines
2.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
inherit (lib) getExe;
|
|
in
|
|
{
|
|
config = {
|
|
custom.cifs-mounts = [ "forgejo" ];
|
|
services.forgejo = {
|
|
enable = true;
|
|
# Use cutting edge instead of lts
|
|
package = pkgs.forgejo;
|
|
repositoryRoot = "/mnt/storage/forgejo/repositories";
|
|
lfs = {
|
|
enable = true;
|
|
contentDir = "/mnt/storage/forgejo/lfs";
|
|
};
|
|
settings = {
|
|
service.DISABLE_REGISTRATION = true;
|
|
server = {
|
|
ROOT_URL = "https://git.xinyang.life/";
|
|
START_SSH_SERVER = false;
|
|
SSH_USER = config.services.forgejo.user;
|
|
SSH_DOMAIN = "ssh.xinyang.life";
|
|
SSH_PORT = 22;
|
|
LFS_MAX_FILE_SIZE = 10737418240;
|
|
LANDING_PAGE = "/explore/repos";
|
|
};
|
|
repository = {
|
|
ENABLE_PUSH_CREATE_USER = true;
|
|
};
|
|
service = {
|
|
ENABLE_BASIC_AUTHENTICATION = false;
|
|
};
|
|
oauth2 = {
|
|
ENABLED = false; # Disable forgejo as oauth2 provider
|
|
};
|
|
oauth2_client = {
|
|
ACCOUNT_LINKING = "auto";
|
|
USERNAME = "email";
|
|
ENABLE_AUTO_REGISTRATION = true;
|
|
UPDATE_AVATAR = false;
|
|
OPENID_CONNECT_SCOPES = "openid profile email groups";
|
|
};
|
|
other = {
|
|
SHOW_FOOTER_VERSION = false;
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services.forgejo = {
|
|
serviceConfig = {
|
|
EnvironmentFile = config.sops.secrets."forgejo/env".path;
|
|
ExecStartPost = ''
|
|
${getExe config.services.forgejo.package} admin auth update-oauth \
|
|
--id 1 \
|
|
--name kanidm \
|
|
--provider openidConnect \
|
|
--key forgejo \
|
|
--secret $CLIENT_SECRET \
|
|
--icon-url https://auth.xinyang.life/pkg/img/favicon.png \
|
|
--group-claim-name forgejo_role --admin-group Admin
|
|
'';
|
|
};
|
|
};
|
|
|
|
users.users.git = {
|
|
isSystemUser = true;
|
|
useDefaultShell = true;
|
|
group = "git";
|
|
extraGroups = [ "forgejo" ];
|
|
};
|
|
users.groups.git = { };
|
|
|
|
services.caddy.enable = true;
|
|
services.caddy.virtualHosts."https://git.xinyang.life:443".extraConfig = ''
|
|
reverse_proxy http://${config.services.gitea.settings.server.DOMAIN}:${toString config.services.gitea.settings.server.HTTP_PORT}
|
|
'';
|
|
};
|
|
}
|