chris/sneeuwvlok
chris/sneeuwvlok
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(forgejo): update config to use secrets
Some checks failed
Test action / kaas (push) Failing after 1s
Details

Browse source
This commit is contained in:
Chris Kruining 2025-11-03 15:19:41 +01:00
parent f33f05a5b6
commit 9b819a2a58
No known key found for this signature in database
GPG key ID: EB894A3560CCCAD2
1 changed files with 40 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

51
modules/nixos/services/development/forgejo/default.nix
View file

@ -1,6 +1,7 @@
{ config, lib, pkgs, namespace, ... }: { config, lib, pkgs, namespace, ... }:
let let
inherit (lib) mkIf mkEnableOption; inherit (builtins) toString;
inherit (lib) mkIf mkEnableOption mkOption;
cfg = config.${namespace}.services.development.forgejo; cfg = config.${namespace}.services.development.forgejo;
domain = "git.amarth.cloud"; domain = "git.amarth.cloud";
@ -8,6 +9,15 @@ in
{ {
options.${namespace}.services.development.forgejo = { options.${namespace}.services.development.forgejo = {
enable = mkEnableOption "Forgejo"; enable = mkEnableOption "Forgejo";
port = mkOption {
type = lib.types.port;
default = 5002;
example = "1234";
description = ''
Which port to bind forgejo to
'';
};
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
@ -33,7 +43,7 @@ in
server = { server = {
DOMAIN = domain; DOMAIN = domain;
ROOT_URL = "https://${domain}/"; ROOT_URL = "https://${domain}/";
HTTP_PORT = 5002; HTTP_PORT = cfg.port;
LANDING_PAGE = "explore"; LANDING_PAGE = "explore";
}; };
@ -83,7 +93,7 @@ in
openid = { openid = {
ENABLE_OPENID_SIGNIN = true; ENABLE_OPENID_SIGNIN = true;
ENABLE_OPENID_SIGNUP = true; ENABLE_OPENID_SIGNUP = true;
WHITELISTED_URIS = "https://auth.amarth.cloud"; WHITELISTED_URIS = "https://auth.kruining.eu";
}; };
oauth2_client = { oauth2_client = {
@ -102,6 +112,10 @@ in
SHOW_FOOTER_TEMPLATE_LOAD_TIME = false; SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;
}; };
metrics = {
ENABLED = true;
};
api = { api = {
ENABLE_SWAGGER = false; ENABLE_SWAGGER = false;
}; };
@ -120,9 +134,9 @@ in
PROTOCOL = "smtp+starttls"; PROTOCOL = "smtp+starttls";
SMTP_ADDR = "black-mail.nl"; SMTP_ADDR = "black-mail.nl";
SMTP_PORT = 587; SMTP_PORT = 587;
FROM = "info@amarth.cloud"; FROM = "chris@kruining.eu";
USER = "info@amarth.cloud"; USER = "chris@kruining.eu";
PASSWD = "__TODO_USE_SOPS__"; PASSWD_URI = "file:${config.sops.secrets."forgejo/email".path}";
}; };
}; };
}; };
@ -137,8 +151,8 @@ in
url = "https://git.amarth.cloud"; url = "https://git.amarth.cloud";
# Obtaining the path to the runner token file may differ # Obtaining the path to the runner token file may differ
# tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
# tokenFile = config.age.secrets.forgejo-runner-token.path; tokenFile = config.sops.secrets."forgejo/action_runner_token".path;
token = "ZBetud1F0IQ9VjVFpZ9bu0FXgx9zcsy1x25yvjhw"; # token = "ZBetud1F0IQ9VjVFpZ9bu0FXgx9zcsy1x25yvjhw";
labels = [ labels = [
"default:docker://nixos/nix:latest" "default:docker://nixos/nix:latest"
"ubuntu:docker://ubuntu:24-bookworm" "ubuntu:docker://ubuntu:24-bookworm"
@ -153,17 +167,32 @@ in
caddy = { caddy = {
enable = true; enable = true;
virtualHosts = { virtualHosts = {
${domain}.extraConfig = '' "${domain}".extraConfig = ''
# import auth-z # import auth
# stupid dumb way to prevent the login page and go to zitadel instead # stupid dumb way to prevent the login page and go to zitadel instead
# be aware that this does not disable local login at all! # be aware that this does not disable local login at all!
# rewrite /user/login /user/oauth2/Zitadel # rewrite /user/login /user/oauth2/Zitadel
reverse_proxy http://127.0.0.1:5002 reverse_proxy http://127.0.0.1:${toString cfg.port}
''; '';
}; };
}; };
}; };
sops.secrets = {
"forgejo/action_runner_token" = {
owner = "gitea-runner";
group = "gitea-runner";
restartUnits = [ "gitea-runner-default.service" ];
};
"forgejo/email" = {
owner = "forgejo";
group = "forgejo";
key = "email/chris_kruining_eu";
restartUnits = [ "forgejo.service" ];
};
};
}; };
} }